{"record":{"id":"ae6394513612c533","repo":"elsa-workflows/elsa-core","slug":"the-configured-secret-binding-could-not-be-resolved-ae6394","errorCode":null,"errorMessage":"The configured secret binding could not be resolved.","messagePattern":"The configured secret binding could not be resolved\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.ExternalAuthentication/Services/ConfigurationSecretBindingResolver.cs","lineNumber":29,"sourceCode":"{\n    public const string ResolverType = \"configuration\";\n    public string Type => ResolverType;\n\n    public ValueTask<SecretBindingState> GetStateAsync(SecretBinding binding, CancellationToken cancellationToken = default)\n    {\n        cancellationToken.ThrowIfCancellationRequested();\n        EnsureType(binding);\n        var configured = !string.IsNullOrWhiteSpace(configuration[binding.Reference]);\n        return ValueTask.FromResult(new SecretBindingState(configured, configured));\n    }\n\n    public ValueTask<ResolvedSecretBinding> ResolveAsync(SecretBinding binding, CancellationToken cancellationToken = default)\n    {\n        cancellationToken.ThrowIfCancellationRequested();\n        EnsureType(binding);\n        var value = configuration[binding.Reference];\n        if (string.IsNullOrWhiteSpace(value))\n            throw new InvalidOperationException(\"The configured secret binding could not be resolved.\");\n        return ValueTask.FromResult(new ResolvedSecretBinding(new(value), hasher.Hash($\"{ResolverType}:{binding.Reference}:{value}\")));\n    }\n\n    private static void EnsureType(SecretBinding binding)\n    {\n        if (!string.Equals(binding.ResolverType, ResolverType, StringComparison.Ordinal) || string.IsNullOrWhiteSpace(binding.Reference))\n            throw new InvalidOperationException(\"The configured secret binding is invalid.\");\n    }\n}\n","sourceCodeStart":11,"sourceCodeEnd":39,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.ExternalAuthentication/Services/ConfigurationSecretBindingResolver.cs#L11-L39","documentation":"The ConfigurationSecretBindingResolver reads a secret from IConfiguration using the binding's Reference as a configuration key. It throws when the resolved value is null, empty, or whitespace, meaning the configuration path referenced by the SecretBinding does not yield a usable secret value.","triggerScenarios":"Thrown from ResolveAsync when configuration[binding.Reference] returns null/whitespace: the key is absent from appsettings/environment variables, the value is an empty string, the key is misspelled or the wrong case-sensitive path, or the configuration provider section was not loaded.","commonSituations":"Running without the environment variable that production uses; appsettings.{Environment}.json not loaded; key renamed in config while stored SecretBinding references the old path; container deployment missing the secret mount; testing locally without the User Secrets entry.","solutions":["Add the secret value at the exact configuration path referenced by binding.Reference (e.g. dotnet user-secrets set or env var).","Verify the Reference string matches the configuration key exactly (section separators ':', correct environment).","Check which configuration sources are registered/loaded in this environment (appsettings.json, environment, user secrets, key vault provider).","If the key was renamed, update the stored connection's SecretBinding reference to the new path."],"exampleFix":"// before (appsettings.json missing the value)\n{ }\n// after\n{ \"ExternalAuth\": { \"MyIdp\": { \"ClientSecret\": \"s3cr3t\" } } }\n// matching binding reference: \"ExternalAuth:MyIdp:ClientSecret\"","handlingStrategy":"validation","validationCode":"// Before resolving, verify the config key exists and is non-empty\nvar value = configuration[binding.Reference];\nif (string.IsNullOrWhiteSpace(value))\n    throw new InvalidOperationException($\"Configuration key '{binding.Reference}' is missing or empty.\");","typeGuard":null,"tryCatchPattern":"try\n{\n    var resolved = await resolver.ResolveAsync(binding, ct);\n}\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"could not be resolved\"))\n{\n    logger.LogError(ex, \"Secret missing in configuration for reference {Reference}\", binding.Reference);\n}","preventionTips":["Validate required config keys at application startup (fail fast).","Keep binding references and configuration keys in a single source of truth.","Add environment smoke tests that resolve all configured secret bindings.","Use user secrets in development and mounted secrets in containers, verified in CI."],"tags":["configuration","secrets","missing-config"],"backgroundTag":"missing-config-value","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}