{"record":{"id":"66b3c5dcdc531aeb","repo":"elsa-workflows/elsa-core","slug":"reject-safereason","errorCode":null,"errorMessage":"{reject.SafeReason}","messagePattern":"\\{reject\\.SafeReason\\}","errorType":"exception","errorClass":"ExternalIdentityUnlinkedException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.ExternalAuthentication/Services/DefaultExternalIdentityResolver.cs","lineNumber":42,"sourceCode":"        if (existingLink is not null)\n        {\n            ValidateLink(existingLink, context);\n            return new(existingLink.UserId, false);\n        }\n\n        var selection = GetPolicySelection(context.Connection);\n        var policy = _policies.GetValueOrDefault(selection.Type)\n            ?? throw new InvalidOperationException($\"The unlinked identity policy '{selection.Type}' is not available.\");\n        var decision = await policy.EvaluateAsync(new(\n            context.TargetTenantId,\n            context.Connection,\n            context.Identity,\n            context.ProjectedClaims,\n            selection.Settings), cancellationToken);\n\n        var result = decision switch\n        {\n            UnlinkedIdentityDecision.Reject reject => throw new ExternalIdentityUnlinkedException(reject.SafeReason),\n            UnlinkedIdentityDecision.CreateUser createUser => await provisioner.CreateLinkOrGetExistingAsync(\n                new(context.TargetTenantId, connectionKey, context.Identity, createUser.Proposal), cancellationToken),\n            UnlinkedIdentityDecision.LinkExistingUser linkExistingUser => await provisioner.CreateLinkOrGetExistingAsync(\n                new(context.TargetTenantId, connectionKey, context.Identity, null, linkExistingUser.UserId), cancellationToken),\n            _ => throw new InvalidOperationException(\"The unlinked identity policy returned an unsupported decision.\")\n        };\n\n        ValidateLink(result.Link, context);\n        return new(result.UserId, result.WasCreated);\n    }\n\n    public ValueTask<bool> RecordSuccessfulSignInAsync(\n        string tenantId,\n        string connectionKey,\n        ExternalIdentity identity,\n        string userId,\n        DateTimeOffset signedInAt,\n        CancellationToken cancellationToken = default) =>","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.ExternalAuthentication/Services/DefaultExternalIdentityResolver.cs#L24-L60","documentation":"Thrown by DefaultExternalIdentityResolver.ResolveAsync when the selected unlinked identity policy evaluates the sign-in and returns a rejection: the exception surfaces the policy's SafeReason verbatim. It means the policy explicitly declined to link or resolve the external identity (e.g. auto-linking disallowed for this identity/tenant), not an infrastructure failure.","triggerScenarios":"Thrown at src/modules/Elsa.ExternalAuthentication/Services/DefaultExternalIdentityResolver.cs:42 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Read the surfaced SafeReason to learn which policy condition rejected the identity.","Adjust the connection's unlinked identity policy configuration (e.g. enable manual linking or a more permissive policy).","Have the user complete an explicit link flow instead of relying on automatic resolution."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}