{"record":{"id":"31d2517438053ece","repo":"elsa-workflows/elsa-core","slug":"the-requested-elsa-user-does-not-exist","errorCode":null,"errorMessage":"The requested Elsa user does not exist.","messagePattern":"The requested Elsa user does not exist\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.ExternalAuthentication/Services/ExternalIdentityUserProvisioningService.cs","lineNumber":33,"sourceCode":"    IUserProvider userProvider,\n    IRoleProvider roleProvider,\n    IIdentityGenerator identityGenerator)\n{\n    private const int MaximumUserNameAttempts = 10;\n\n    /// <summary>\n    /// Resolves an explicitly selected user or creates a credential-less user from the supplied proposal.\n    /// </summary>\n    public async ValueTask<(User User, bool WasCreated)> ResolveAsync(\n        ProvisioningRequest request,\n        Func<string, bool>? tryReserveUserName = null,\n        CancellationToken cancellationToken = default)\n    {\n        if (!string.IsNullOrWhiteSpace(request.ExistingUserId))\n        {\n            var existingUser = await userProvider.FindAsync(new()\n                                   { Id = request.ExistingUserId }, cancellationToken)\n                ?? throw new InvalidOperationException(\"The requested Elsa user does not exist.\");\n            if (!string.Equals(existingUser.TenantId, request.TenantId, StringComparison.Ordinal))\n                throw new InvalidOperationException(\"The requested Elsa user is outside the target tenant.\");\n\n            return (existingUser, false);\n        }\n\n        var proposal = request.Proposal ?? throw new InvalidOperationException(\"A user creation proposal is required for an unlinked external identity.\");\n        var roleIds = await ResolveRoleIdsAsync(proposal.DefaultRoleIds, cancellationToken);\n        var prefix = NormalizeUserNamePrefix(proposal.UserNamePrefix);\n        for (var attempt = 0; attempt < MaximumUserNameAttempts; attempt++)\n        {\n            var name = $\"{prefix}-{identityGenerator.GenerateId()}\";\n            if (tryReserveUserName is not null && !tryReserveUserName(name))\n                continue;\n            if (await userProvider.FindAsync(new()\n                    { Name = name }, cancellationToken) is not null)\n                continue;\n","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.ExternalAuthentication/Services/ExternalIdentityUserProvisioningService.cs#L15-L51","documentation":"ExternalIdentityUserProvisioningService.ResolveAsync throws this when the caller supplies request.ExistingUserId but no Elsa user with that ID can be found via IUserProvider.FindAsync. The service only links an external identity to an explicitly chosen existing user, and it refuses to silently create one when the given ID is stale or wrong. It indicates a reference to a deleted or never-existing Elsa user.","triggerScenarios":"Calling ResolveAsync (directly or via an external-identity provisioner such as an OIDC/legacy login flow) with a ProvisioningRequest whose ExistingUserId is set to an ID that does not exist in the Elsa user store — e.g. the user was deleted in Elsa while still referenced externally, the ID was truncated/mangled, or the wrong store/tenant database is queried.","commonSituations":"Re-running provisioning after an admin deleted Elsa users; pointing the app at a fresh/empty database while still carrying old external identity links; copying user IDs between environments; case- or whitespace-corrupted IDs in configuration.","solutions":["Verify the ExistingUserId value matches a real row in the Elsa user store (check via the admin API or database query on Users).","Remove or regenerate the external identity link so a fresh user is created from the Proposal instead of linking to the stale ID.","Confirm the application connects to the correct database/tenant where the user actually exists.","Re-provision the user: clear the stored external identity mapping and log in again so ResolveAsync creates a new user."],"exampleFix":"// before: stale stored link\nrequest.ExistingUserId = storedLinkId; // deleted user\n// after: validate before linking\nvar user = await userProvider.FindAsync(new() { Id = storedLinkId }, ct);\nrequest.ExistingUserId = user is null ? null : storedLinkId; // fall back to proposal-based creation","handlingStrategy":"validation","validationCode":"if (!string.IsNullOrWhiteSpace(request.ExistingUserId))\n{\n    var user = await userProvider.FindAsync(new() { Id = request.ExistingUserId }, ct);\n    if (user is null)\n    {\n        // stale link — drop it so a fresh user is provisioned from the proposal\n        request.ExistingUserId = null;\n    }\n}","typeGuard":"bool IsValidExistingUserId(ProvisioningRequest r) => string.IsNullOrWhiteSpace(r.ExistingUserId) || !string.IsNullOrWhiteSpace(r.ExistingUserId); // existence must be checked against the store asynchronously","tryCatchPattern":"try\n{\n    var (user, created) = await provisioning.ResolveAsync(request, ct: ct);\n}\ncatch (InvalidOperationException ex) when (ex.Message == \"The requested Elsa user does not exist.\")\n{\n    request.ExistingUserId = null; // re-resolve via proposal path\n    var (user, created) = await provisioning.ResolveAsync(request, ct: ct);\n}","preventionTips":["Validate the stored external identity link against the user store at startup or before each login.","Cascade-delete external identity links when Elsa users are deleted.","Never hardcode or copy user IDs across environments."],"tags":["identity","user-not-found","provisioning","external-authentication"],"backgroundTag":"user-not-found","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}