{"record":{"id":"0dc3e3d457a95286","repo":"elsa-workflows/elsa-core","slug":"the-configured-secret-binding-is-incompatible-with-the","errorCode":null,"errorMessage":"The configured secret binding is incompatible with the required type or scope.","messagePattern":"The configured secret binding is incompatible with the required type or scope\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.ExternalAuthentication.Secrets/Services/ElsaSecretBindingResolver.cs","lineNumber":73,"sourceCode":"        var secret = await secretManager.GetAsync(binding.Reference, cancellationToken);\n        if (secret is null)\n            return new(false, false);\n\n        var configured = secret is { Status: SecretStatus.Active, LatestActiveVersion: not null };\n        if (!configured || !IsCompatible(secret, binding))\n            return new(configured, false);\n\n        var test = await secretManager.TestAsync(secret.Name, cancellationToken);\n        return new(true, test.Succeeded);\n    }\n\n    public async ValueTask<ResolvedSecretBinding> ResolveAsync(SecretBinding binding, CancellationToken cancellationToken = default)\n    {\n        EnsureResolverType(binding);\n        var secret = await secretManager.GetAsync(binding.Reference, cancellationToken)\n            ?? throw new InvalidOperationException(\"The configured secret binding could not be resolved.\");\n        if (!IsCompatible(secret, binding))\n            throw new InvalidOperationException(\"The configured secret binding is incompatible with the required type or scope.\");\n        if (secret is not { Status: SecretStatus.Active, LatestActiveVersion: { } version })\n            throw new InvalidOperationException(\"The configured secret binding is not active.\");\n\n        var payload = await secretManager.ResolvePayloadAsync(secret, cancellationToken);\n        if (payload.Value is null)\n            throw new InvalidOperationException(\"The configured secret binding could not be resolved.\");\n\n        var fingerprint = handleHasher.Hash($\"{ResolverType}:{secret.Id}:{version.Version}:{version.CreatedAt.ToUnixTimeMilliseconds()}\");\n        return new(new(payload.Value), fingerprint);\n    }\n\n    private static void EnsureResolverType(SecretBinding binding)\n    {\n        if (!string.Equals(binding.ResolverType, ResolverType, StringComparison.Ordinal))\n            throw new InvalidOperationException(\"The secret binding selects a different resolver type.\");\n        if (string.IsNullOrWhiteSpace(binding.Reference))\n            throw new InvalidOperationException(\"The secret binding reference is required.\");\n    }","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.ExternalAuthentication.Secrets/Services/ElsaSecretBindingResolver.cs#L55-L91","documentation":"ResolveAsync validates that the resolved secret is compatible with the binding's required type and scope via IsCompatible. When the stored secret's type or scope does not match what the binding requires, resolution fails rather than returning material usable in the wrong context.","triggerScenarios":"Calling ResolveAsync on a binding whose Reference points to a secret created for a different type or scope; e.g. reusing one secret reference across connections or scopes, or a secret whose stored metadata was changed after the binding was created.","commonSituations":"Manually editing or migrating secret records and altering Type/Scope fields; pointing two bindings at one reference and later changing scope expectations; schema migrations that renamed scope values.","solutions":["Create a new secret with the correct type/scope via StageAsync and publish a matching binding","Correct the secret's Type/Scope metadata so IsCompatible passes","Update the binding to reference a secret of the required type/scope"],"exampleFix":"// before\nbinding.Reference = otherScopeSecret.Reference; // wrong type/scope\n// after\nvar staged = await resolver.StageAsync(new ManagedSecretBindingWriteRequest { ConnectionId = connId, FieldName = \"clientSecret\" });\nbinding.Reference = staged.Reference;","handlingStrategy":"validation","validationCode":"var state = await resolver.GetStateAsync(binding);\nif (state.SecretExists && !state.IsCompatible) throw new InvalidOperationException(\"Secret type/scope does not match the binding requirement.\");","typeGuard":"bool IsCompatibleBinding(SecretBinding b) => b.ResolverType == \"external-authentication\" && b.Ownership == SecretBindingOwnership.Managed;","tryCatchPattern":"try { return await resolver.ResolveAsync(binding); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"incompatible\"))\n{ throw new ConfigurationException(\"Secret binding references a secret of the wrong type or scope.\", ex); }","preventionTips":["Never share a single secret reference across bindings that require different types/scopes","Keep secret Type/Scope metadata immutable after creation; stage a new secret instead of editing","Test compatibility after any secret-store migration or schema change"],"tags":["secrets","compatibility","type-mismatch"],"backgroundTag":"type-mismatch","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}