{"record":{"id":"33b253ec8c9d7bd8","repo":"elsa-workflows/elsa-core","slug":"the-configured-secret-binding-is-invalid","errorCode":null,"errorMessage":"The configured secret binding is invalid.","messagePattern":"The configured secret binding is invalid\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.ExternalAuthentication/Services/ConfigurationSecretBindingResolver.cs","lineNumber":36,"sourceCode":"        EnsureType(binding);\n        var configured = !string.IsNullOrWhiteSpace(configuration[binding.Reference]);\n        return ValueTask.FromResult(new SecretBindingState(configured, configured));\n    }\n\n    public ValueTask<ResolvedSecretBinding> ResolveAsync(SecretBinding binding, CancellationToken cancellationToken = default)\n    {\n        cancellationToken.ThrowIfCancellationRequested();\n        EnsureType(binding);\n        var value = configuration[binding.Reference];\n        if (string.IsNullOrWhiteSpace(value))\n            throw new InvalidOperationException(\"The configured secret binding could not be resolved.\");\n        return ValueTask.FromResult(new ResolvedSecretBinding(new(value), hasher.Hash($\"{ResolverType}:{binding.Reference}:{value}\")));\n    }\n\n    private static void EnsureType(SecretBinding binding)\n    {\n        if (!string.Equals(binding.ResolverType, ResolverType, StringComparison.Ordinal) || string.IsNullOrWhiteSpace(binding.Reference))\n            throw new InvalidOperationException(\"The configured secret binding is invalid.\");\n    }\n}\n","sourceCodeStart":18,"sourceCodeEnd":39,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.ExternalAuthentication/Services/ConfigurationSecretBindingResolver.cs#L18-L39","documentation":"EnsureType validates that a SecretBinding is actually meant for the Configuration resolver: ResolverType must equal this resolver's Type and Reference must be a non-empty string. Any binding with a mismatched resolver type or missing reference is rejected before resolution.","triggerScenarios":"Thrown from ResolveAsync/GetStateAsync when the stored SecretBinding.ResolverType does not match the Configuration resolver's type string (e.g. a binding created for another resolver type routed here), or when Reference is null, empty, or whitespace.","commonSituations":"Hand-written or migrated SecretBinding JSON missing the reference field; a typo in the resolverType value; deserialization producing default/empty binding fields; switching a connection between resolvers without updating the binding.","solutions":["Set binding.Reference to the configuration path holding the secret.","Set binding.ResolverType to the exact type string registered for the configuration resolver.","Inspect the stored connection record for null/empty binding fields produced by migration or manual edits.","Confirm the binding is not intended for a different resolver; if so, register/choose that resolver instead."],"exampleFix":"// before\nnew SecretBinding { ResolverType = \"config\", Reference = null }\n// after\nnew SecretBinding { ResolverType = \"Configuration\", Reference = \"ExternalAuth:MyIdp:ClientSecret\" }","handlingStrategy":"validation","validationCode":"// Validate the binding before handing it to the resolver\nbool IsValid(SecretBinding b, string expectedType) =>\n    string.Equals(b.ResolverType, expectedType, StringComparison.Ordinal)\n    && !string.IsNullOrWhiteSpace(b.Reference);","typeGuard":"static bool IsConfigurationBinding(SecretBinding b, string configurationResolverType) =>\n    string.Equals(b.ResolverType, configurationResolverType, StringComparison.Ordinal)\n    && !string.IsNullOrWhiteSpace(b.Reference);","tryCatchPattern":null,"preventionTips":["Create SecretBinding values only through factory/API helpers that enforce non-empty reference and resolver type.","Never hand-edit stored binding JSON; use the connection management API.","Assert binding validity in unit tests for any custom resolver integration."],"tags":["configuration","secrets","validation","argument-validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}