{"record":{"id":"a2c968f520bd821c","repo":"elsa-workflows/elsa-core","slug":"the-configured-secret-binding-is-not-active","errorCode":null,"errorMessage":"The configured secret binding is not active.","messagePattern":"The configured secret binding is not active\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.ExternalAuthentication.Secrets/Services/ElsaSecretBindingResolver.cs","lineNumber":75,"sourceCode":"            return new(false, false);\n\n        var configured = secret is { Status: SecretStatus.Active, LatestActiveVersion: not null };\n        if (!configured || !IsCompatible(secret, binding))\n            return new(configured, false);\n\n        var test = await secretManager.TestAsync(secret.Name, cancellationToken);\n        return new(true, test.Succeeded);\n    }\n\n    public async ValueTask<ResolvedSecretBinding> ResolveAsync(SecretBinding binding, CancellationToken cancellationToken = default)\n    {\n        EnsureResolverType(binding);\n        var secret = await secretManager.GetAsync(binding.Reference, cancellationToken)\n            ?? throw new InvalidOperationException(\"The configured secret binding could not be resolved.\");\n        if (!IsCompatible(secret, binding))\n            throw new InvalidOperationException(\"The configured secret binding is incompatible with the required type or scope.\");\n        if (secret is not { Status: SecretStatus.Active, LatestActiveVersion: { } version })\n            throw new InvalidOperationException(\"The configured secret binding is not active.\");\n\n        var payload = await secretManager.ResolvePayloadAsync(secret, cancellationToken);\n        if (payload.Value is null)\n            throw new InvalidOperationException(\"The configured secret binding could not be resolved.\");\n\n        var fingerprint = handleHasher.Hash($\"{ResolverType}:{secret.Id}:{version.Version}:{version.CreatedAt.ToUnixTimeMilliseconds()}\");\n        return new(new(payload.Value), fingerprint);\n    }\n\n    private static void EnsureResolverType(SecretBinding binding)\n    {\n        if (!string.Equals(binding.ResolverType, ResolverType, StringComparison.Ordinal))\n            throw new InvalidOperationException(\"The secret binding selects a different resolver type.\");\n        if (string.IsNullOrWhiteSpace(binding.Reference))\n            throw new InvalidOperationException(\"The secret binding reference is required.\");\n    }\n\n    private static bool IsCompatible(Secret secret, SecretBinding binding) =>","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.ExternalAuthentication.Secrets/Services/ElsaSecretBindingResolver.cs#L57-L93","documentation":"ResolveAsync requires the secret to be in SecretStatus.Active and to have a LatestActiveVersion. Secrets in other statuses (e.g. disabled, pending, revoked) or without an active version cannot supply usable material and cause this error.","triggerScenarios":"Calling ResolveAsync when the referenced secret's Status is not Active, or its LatestActiveVersion is null — e.g. the secret was disabled, all versions were superseded/revoked, or the secret was created without any active version.","commonSituations":"A secret disabled by an administrator or by security policy; rotation pipelines that left no active version; secrets expired after a rotation window passed.","solutions":["Re-enable/reactivate the secret or publish a new active version via StageAsync and CAS publish","Check the secret's status via GetStateAsync before resolving and surface a clear configuration error to the user","Fix the rotation process so it always publishes a new active version before retiring the old one"],"exampleFix":"// before\nvar resolved = await resolver.ResolveAsync(binding);\n// after\nvar state = await resolver.GetStateAsync(binding);\nif (state is { Status: SecretStatus.Active, LatestActiveVersion: not null }) {\n    var resolved = await resolver.ResolveAsync(binding);\n} else {\n    // re-stage and publish a new active secret version\n}","handlingStrategy":"try-catch","validationCode":"var state = await resolver.GetStateAsync(binding);\nif (!state.IsActive) throw new InvalidOperationException(\"Secret is not active; rotate or re-enable it before use.\");","typeGuard":"bool IsActiveSecret(SecretBinding b) => b is { Status: SecretStatus.Active, LatestActiveVersion: not null };","tryCatchPattern":"try { return await resolver.ResolveAsync(binding); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"not active\"))\n{ throw new ConfigurationException(\"The referenced secret is inactive; rotate or re-enable it.\", ex); }","preventionTips":["Design rotation to publish the new active version before retiring the old one","Alert on secrets in non-active statuses that live bindings reference","Re-enable or re-stage secrets after administrative disables rather than leaving bindings dangling"],"tags":["secrets","state","rotation"],"backgroundTag":"invalid-state-transition","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}