{"record":{"id":"a71e0ce6a9bac468","repo":"microsoft/aspire","slug":"aspireradius082-resource-resource-name-would-be-deployed","errorCode":"ASPIRERADIUS082","errorMessage":"Resource '{resource.Name}' would be deployed with the user name 'guest', which RabbitMQ restricts to loopback connections — the deployed broker would reject every workload that connects to it. Supply an explicit user name, for example AddRabbitMQ(\"{resource.Name}\", userName: builder.AddParameter(\"{resource.Name}user\")), so the same value is both provisioned on the broker and composed into the connection string. Diagnostic: ASPIRERADIUS082.","messagePattern":"Resource '(.+?)' would be deployed with the user name 'guest', which RabbitMQ restricts to loopback connections — the deployed broker would reject every workload that connects to it\\. Supply an explicit user name, for example AddRabbitMQ\\(\"(.+?)\", userName: builder\\.AddParameter\\(\"(.+?)user\"\\)\\), so the same value is both provisioned on the broker and composed into the connection string\\. Diagnostic: ASPIRERADIUS082\\.","errorType":"error_code","errorClass":"RadiusBackingResourceProjectionException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Publishing/RadiusInfrastructureBuilder.cs","lineNumber":2823,"sourceCode":"        // Neither alternative can be made correct silently:\n        //   - emitting `guest` provisions a broker no workload can authenticate against;\n        //   - emitting `radius` instead leaves the connection string Aspire already composed saying\n        //     `guest`, because a default user name arrives as literal text inside the format string\n        //     with no value provider to substitute (the same gap DefaultUserName_RemainsALiteral\n        //     pins), so the two would disagree.\n        // So this fails the publish instead, and names the one-line fix.\n        //\n        // Both spellings of `guest` have to be caught. A literal user name renders as the Bicep\n        // string literal `'guest'`, but a parameter-supplied one renders as a Bicep *identifier*\n        // (`param queueuser`), so the rendered text says nothing about the value. Supplying a\n        // parameter is exactly the remediation the message below recommends, so missing that case\n        // would route users around the guard with the guard's own advice. Parameter values are\n        // normally known at publish time, so resolve it and compare.\n        if (construct.GetSchemaProperty(\"username\") is { } emittedUserName &&\n            (RenderBicepValue(emittedUserName) is \"'guest'\" ||\n             await ResolvesToGuestUserNameAsync(userNameParameter).ConfigureAwait(false)))\n        {\n            throw CreateRabbitMqGuestUserNameException(resource);\n        }\n\n        // `queue` is deliberately not emitted. It is optional on the type, and Aspire's model has no\n        // queue concept to map from — AddRabbitMQ declares a broker, not a queue — so any value here\n        // would be invented. The UDT's own default (`jobs`) applies instead, and consumers create\n        // the queues they need through the AMQP client.\n    }\n\n    /// <summary>\n    /// Determines whether a parameter-supplied user name resolves to RabbitMQ's <c>guest</c>\n    /// account, which the emitted Bicep cannot reveal because a parameter renders as an identifier\n    /// rather than as its value.\n    /// </summary>\n    /// <remarks>\n    /// A parameter whose value cannot be produced while publishing (no value configured, or a\n    /// default only the deployment can materialize) is treated as not being <c>guest</c>: the guard\n    /// exists to catch the value Aspire itself composed into the connection string, and failing the\n    /// publish on an unknowable value would reject models that are perfectly valid.","sourceCodeStart":2805,"sourceCodeEnd":2841,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Publishing/RadiusInfrastructureBuilder.cs#L2805-L2841","documentation":"RadiusInfrastructureBuilder emits the RabbitMQ construct's Bicep and guards against the 'guest' user name at build time: if the emitted username property renders as the literal 'guest', or the backing user-name parameter resolves to 'guest', it throws CreateRabbitMqGuestUserNameException (ASPIRERADIUS082). This is the infrastructure-generation counterpart of the deploy-time check, deliberately comparing the resolved parameter rather than just the Bicep literal so the guard cannot be bypassed with a parameter indirection.","triggerScenarios":"Publishing/transforming an Aspire model where AddRabbitMQ's emitted username schema property renders to 'guest', or its userName parameter's GetValueAsync resolves to \"guest\" during Bicep generation for a Radius environment.","commonSituations":"RabbitMQ resource declared without an explicit userName so defaults to guest; a parameter default of 'guest'; environment config supplying 'guest'; local development using RabbitMQ's default guest account being published unchanged to Radius.","solutions":["Supply an explicit non-'guest' userName parameter: AddRabbitMQ(\"name\", userName: builder.AddParameter(\"nameuser\"))","Update the parameter source (parameter default, environment variable, secret reference) so it no longer resolves to 'guest'","Redeploy/publish after changing the credential so the generated Bicep and connection string both carry the new user name","Keep the same parameter wired to both the broker resource and consuming connection strings to avoid credential drift"],"exampleFix":"// before: username emitted as 'guest'\nvar rabbit = builder.AddRabbitMQ(\"bus\");\n\n// after: explicit parameterized user name\nvar busUser = builder.AddParameter(\"bususer\");\nvar busPass = builder.AddParameter(\"buspass\", secret: true);\nvar rabbit = builder.AddRabbitMQ(\"bus\", userName: busUser, password: busPass);","handlingStrategy":"validation","validationCode":"// Check the resolved user-name parameter before publish\nvar resolved = await userNameParameter.GetValueAsync(ct);\nif (resolved is null || resolved == \"guest\")\n    throw new InvalidOperationException(\"RabbitMQ userName parameter resolves to 'guest'; supply a real user name.\");","typeGuard":"bool NotGuest(string? v) => !string.IsNullOrWhiteSpace(v) && v != \"guest\";","tryCatchPattern":"try\n{\n    await builder.CreateInfrastructureAsync(model, ct);\n}\ncatch (Exception ex) when (ex.Message.Contains(\"ASPIRERADIUS082\"))\n{\n    // Provisioning-time guard: fix the AddRabbitMQ userName parameter and regenerate.\n    throw;\n}","preventionTips":["Declare RabbitMQ credentials as parameters with real (non-guest) defaults or required prompts","Review generated Bicep for username: 'guest' literals before publishing","Rotate to named per-environment credentials rather than shared guest access"],"tags":["rabbitmq","radius","bicep","credentials","diagnostics"],"backgroundTag":"rabbitmq-guest-user","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}