{"record":{"id":"aeddf74d69ccd3aa","repo":"microsoft/aspire","slug":"unknown-azure-credential-type-credential-gettype-name","errorCode":null,"errorMessage":"Unknown Azure credential type '{credential.GetType().Name}'.","messagePattern":"Unknown Azure credential type '(.+?)'\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Publishing/RadCredentialRegisterStep.cs","lineNumber":225,"sourceCode":"        var distinctIdentities = configured.Select(static c => c.Identity).Distinct(StringComparer.Ordinal).Count();\n        if (distinctIdentities <= 1)\n        {\n            return;\n        }\n\n        var envNames = string.Join(\", \", configured.Select(static c => $\"'{c.Env}'\").Distinct(StringComparer.Ordinal));\n        throw new InvalidOperationException(\n            $\"{provider} cloud-provider credentials are registered per Radius installation (global) and \" +\n            $\"are shared across all environments, but environments {envNames} configure different {provider} \" +\n            \"credentials that would overwrite one another. Configure a single shared credential for all \" +\n            \"environments, or deploy them to separate Radius installations. Diagnostic: ASPIRERADIUS011.\");\n    }\n\n    private static string AzureCredentialIdentity(AzureRadiusCredential credential) => credential switch\n    {\n        AzureRadiusCredential.ServicePrincipal sp => $\"sp|{Canonicalize(sp.TenantId)}|{Canonicalize(sp.ClientId)}\",\n        AzureRadiusCredential.WorkloadIdentity wi => $\"wi|{Canonicalize(wi.TenantId)}|{Canonicalize(wi.ClientId)}\",\n        _ => throw new InvalidOperationException($\"Unknown Azure credential type '{credential.GetType().Name}'.\"),\n    };\n\n    private static string AwsCredentialIdentity(AwsRadiusCredential credential) => credential switch\n    {\n        // The access key id identifies the principal; it is bound via a parameter, so its\n        // resource name is used as a stable proxy without resolving the value here.\n        AwsRadiusCredential.AccessKey ak => $\"access-key|{ak.AccessKeyId.Resource.Name}\",\n        AwsRadiusCredential.Irsa irsa => $\"irsa|{irsa.IamRoleArn}\",\n        _ => throw new InvalidOperationException($\"Unknown AWS credential type '{credential.GetType().Name}'.\"),\n    };\n\n    // Inputs are validated as GUIDs before reaching here; normalize to the canonical \"D\"\n    // form so differing casing/formatting of the same GUID is not treated as a conflict.\n    private static string Canonicalize(string guid)\n        => Guid.TryParse(guid, out var parsed) ? parsed.ToString(\"D\") : guid;\n\n    private static async Task<string> ResolveParameterAsync(\n        IResourceBuilder<ParameterResource> parameter,","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Publishing/RadCredentialRegisterStep.cs#L207-L243","documentation":"When building a stable identity string for an Azure Radius credential, the code switches over the known AzureRadiusCredential subtypes (ServicePrincipal, WorkloadIdentity). A credential of any other subtype has no defined identity, so this InvalidOperationException is thrown as an internal exhaustiveness guard.","triggerScenarios":"Passing a custom or newly-added (or incorrectly cast) subclass of AzureRadiusCredential through WithRadiusCredential into credential-conflict validation, where the switch expression finds no matching pattern.","commonSituations":"Upgrading the Aspire.Hosting.Radius package while referencing an older/newer AzureRadiusCredential type from a mismatched package version; hand-rolling a subclass of AzureRadiusCredential that the validator does not recognize.","solutions":["Use only the supported credential kinds: AzureRadiusCredential.ServicePrincipal or AzureRadiusCredential.WorkloadIdentity.","Align all Aspire.Hosting.Radius and related package versions so the credential type matches what this validator knows.","If you believe a new credential type should be supported, file an issue with the type name shown in the message."],"exampleFix":"// before\nvar credential = new MyCustomAzureRadiusCredential(tenantId, clientId);\nenv.WithRadiusCredential(credential);\n\n// after\nvar credential = new AzureRadiusCredential.ServicePrincipal(tenantId, clientId);\nenv.WithRadiusCredential(credential);","handlingStrategy":"type-guard","validationCode":"// Validate the credential kind before registering\nbool IsSupportedAzureCredential(AzureRadiusCredential c) =>\n    c is AzureRadiusCredential.ServicePrincipal or AzureRadiusCredential.WorkloadIdentity;\nif (!IsSupportedAzureCredential(credential)) throw new ArgumentException($\"Unsupported Azure credential type {credential.GetType().Name}\");","typeGuard":"var ok = credential is AzureRadiusCredential.ServicePrincipal or AzureRadiusCredential.WorkloadIdentity;","tryCatchPattern":"try { env.WithRadiusCredential(credential); }\ncatch (InvalidOperationException ex) when (ex.Message.StartsWith(\"Unknown Azure credential type\"))\n{\n    logger.LogError(ex, \"Credential type {Type} is not supported; use ServicePrincipal or WorkloadIdentity.\", credential.GetType().Name);\n}","preventionTips":["Only construct credential types exposed by your exact Aspire.Hosting.Radius package version","Do not subclass AzureRadiusCredential","Keep all Aspire.* package versions in sync to avoid unknown subtypes"],"tags":["radius","azure","credentials","type-mismatch","validation"],"backgroundTag":"unsupported-enum-value","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}