{"record":{"id":"ae0f9dc6ffb663f3","repo":"elsa-workflows/elsa-core","slug":"the-issuer-must-be-an-absolute-https-uri-without-a-query-or","errorCode":null,"errorMessage":"The issuer must be an absolute HTTPS URI without a query or fragment.","messagePattern":"The issuer must be an absolute HTTPS URI without a query or fragment\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.ExternalAuthentication/Services/ExternalIdentityLinkManagementService.cs","lineNumber":236,"sourceCode":"        await sender.SendAsync(\n            new ExternalIdentityLinkReplaced(\n                context,\n                oldLink.Id,\n                newLink?.Id,\n                oldLink.UserId,\n                targetUserId,\n                oldLink.ConnectionKey,\n                targetConnectionKey,\n                conflictingLink?.Id,\n                conflictingLink?.UserId,\n                conflictingLink?.ConnectionKey),\n            cancellationToken);\n    }\n\n    private static string NormalizeIssuer(string issuer)\n    {\n        if (!Uri.TryCreate(issuer?.Trim(), UriKind.Absolute, out var uri) || !string.Equals(uri.Scheme, Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase) || !string.IsNullOrEmpty(uri.Query) || !string.IsNullOrEmpty(uri.Fragment))\n            throw new ArgumentException(\"The issuer must be an absolute HTTPS URI without a query or fragment.\", nameof(issuer));\n        return uri.GetComponents(UriComponents.AbsoluteUri, UriFormat.UriEscaped).TrimEnd('/');\n    }\n\n    private static string NormalizeSubject(string subject)\n    {\n        var normalized = subject?.Trim();\n        if (string.IsNullOrEmpty(normalized) || normalized.Length > 4096)\n            throw new ArgumentException(\"The subject is required and must not exceed 4096 characters.\", nameof(subject));\n        return normalized;\n    }\n\n    private static void ValidateTargetTenant(string tenantId)\n    {\n        ArgumentNullException.ThrowIfNull(tenantId);\n        if (string.Equals(tenantId, ConnectionScope.HostTenantId, StringComparison.Ordinal))\n            throw new ArgumentException(\"External identity links require a resolved tenant.\", nameof(tenantId));\n    }\n}","sourceCodeStart":218,"sourceCodeEnd":254,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.ExternalAuthentication/Services/ExternalIdentityLinkManagementService.cs#L218-L254","documentation":"A validation guard thrown by NormalizeIssuer in ExternalIdentityLinkManagementService: the supplied issuer string is not an absolute URI, is not HTTPS, or carries a query string or fragment. Only a clean absolute HTTPS issuer URL can be normalized (trailing slash trimmed) for use as an external identity link key.","triggerScenarios":"Thrown at src/modules/Elsa.ExternalAuthentication/Services/ExternalIdentityLinkManagementService.cs:236 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass the identity provider's base issuer URL exactly as published in its OIDC discovery metadata (no query or fragment).","Ensure the scheme is https://, not http:// or a relative URL.","Trim any client-side appended parameters before passing the issuer to the link management service."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}