{"record":{"id":"2528bab196e526fe","repo":"elsa-workflows/elsa-core","slug":"the-subject-is-required-and-must-not-exceed-4096-characters","errorCode":null,"errorMessage":"The subject is required and must not exceed 4096 characters.","messagePattern":"The subject is required and must not exceed 4096 characters\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.ExternalAuthentication/Services/ExternalIdentityLinkManagementService.cs","lineNumber":244,"sourceCode":"                targetConnectionKey,\n                conflictingLink?.Id,\n                conflictingLink?.UserId,\n                conflictingLink?.ConnectionKey),\n            cancellationToken);\n    }\n\n    private static string NormalizeIssuer(string issuer)\n    {\n        if (!Uri.TryCreate(issuer?.Trim(), UriKind.Absolute, out var uri) || !string.Equals(uri.Scheme, Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase) || !string.IsNullOrEmpty(uri.Query) || !string.IsNullOrEmpty(uri.Fragment))\n            throw new ArgumentException(\"The issuer must be an absolute HTTPS URI without a query or fragment.\", nameof(issuer));\n        return uri.GetComponents(UriComponents.AbsoluteUri, UriFormat.UriEscaped).TrimEnd('/');\n    }\n\n    private static string NormalizeSubject(string subject)\n    {\n        var normalized = subject?.Trim();\n        if (string.IsNullOrEmpty(normalized) || normalized.Length > 4096)\n            throw new ArgumentException(\"The subject is required and must not exceed 4096 characters.\", nameof(subject));\n        return normalized;\n    }\n\n    private static void ValidateTargetTenant(string tenantId)\n    {\n        ArgumentNullException.ThrowIfNull(tenantId);\n        if (string.Equals(tenantId, ConnectionScope.HostTenantId, StringComparison.Ordinal))\n            throw new ArgumentException(\"External identity links require a resolved tenant.\", nameof(tenantId));\n    }\n}\n\npublic sealed record ExternalIdentityLinkUser(string Id, string DisplayName);\n\npublic abstract record ExternalIdentityLinkPrelinkResult\n{\n    private ExternalIdentityLinkPrelinkResult() { }\n    public sealed record Success(ExternalIdentityLink Link, bool WasCreated) : ExternalIdentityLinkPrelinkResult;\n    public sealed record Conflict(ExternalIdentityLink Link) : ExternalIdentityLinkPrelinkResult;","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.ExternalAuthentication/Services/ExternalIdentityLinkManagementService.cs#L226-L262","documentation":"A validation guard thrown by NormalizeSubject: the subject claim value supplied for an external identity link is null, empty/whitespace after trimming, or longer than 4096 characters. The subject is the provider-side identity key and must be a non-empty bounded string.","triggerScenarios":"Thrown at src/modules/Elsa.ExternalAuthentication/Services/ExternalIdentityLinkManagementService.cs:244 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the identity token or userinfo response actually contains a non-empty 'sub' claim before linking.","Reject upstream providers that issue oversized subjects rather than truncating them.","Trim and validate the subject at the boundary before calling the link management service."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}