{"record":{"id":"e989f1dabc698d56","repo":"microsoft/aspire","slug":"aspireradius010","errorCode":"ASPIRERADIUS010","errorMessage":"WithAzureProvider requires a credential mode to be selected via the configure callback (e.g. azure.WithServicePrincipal(...)). Diagnostic: ASPIRERADIUS010.","messagePattern":"WithAzureProvider requires a credential mode to be selected via the configure callback \\(e\\.g\\. azure\\.WithServicePrincipal\\(\\.\\.\\.\\)\\)\\. Diagnostic: ASPIRERADIUS010\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/CloudProviders/RadiusCloudProviderExtensions.cs","lineNumber":57,"sourceCode":"    [AspireExportIgnore(Reason = \"The credential-selection callback exposes the in-flight provider builder interface, which the ATS exporter cannot render (ASPIREEXPORT008).\")]\n    [Experimental(\"ASPIRERADIUS003\", UrlFormat = \"https://aka.ms/aspire/diagnostics/{0}\")]\n    public static IResourceBuilder<RadiusEnvironmentResource> WithAzureProvider(\n        this IResourceBuilder<RadiusEnvironmentResource> builder,\n        string subscriptionId,\n        string resourceGroup,\n        Action<IAzureRadiusProviderBuilder> configure)\n    {\n        ArgumentNullException.ThrowIfNull(builder);\n        CloudProviderValidation.ValidateGuid(subscriptionId, nameof(subscriptionId));\n        CloudProviderValidation.ValidateNonEmpty(resourceGroup, nameof(resourceGroup));\n        ArgumentNullException.ThrowIfNull(configure);\n\n        var providerBuilder = new AzureRadiusProviderBuilder();\n        configure(providerBuilder);\n\n        if (providerBuilder.Credential is null)\n        {\n            throw new InvalidOperationException(\n                \"WithAzureProvider requires a credential mode to be selected \" +\n                \"via the configure callback (e.g. azure.WithServicePrincipal(...)). \" +\n                \"Diagnostic: ASPIRERADIUS010.\");\n        }\n\n        var config = new AzureRadiusProviderConfig(subscriptionId, resourceGroup, providerBuilder.Credential);\n        RadiusCloudProvidersAnnotation.GetOrAdd(builder.Resource).Azure = config;\n        return builder;\n    }\n\n    /// <summary>\n    /// Attaches an AWS cloud provider to the Radius environment. The\n    /// <paramref name=\"configure\"/> callback selects exactly one credential\n    /// mode (Access Key or IRSA); omitting a selection is an error.\n    /// </summary>\n    /// <param name=\"builder\">The Radius environment resource builder.</param>\n    /// <param name=\"accountId\">12-digit AWS account ID.</param>\n    /// <param name=\"region\">AWS region code (e.g. <c>us-west-2</c>).</param>","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/CloudProviders/RadiusCloudProviderExtensions.cs#L39-L75","documentation":"WithAzureProvider requires the configure callback to select a credential mode on the AzureRadiusProviderBuilder (e.g. azure.WithServicePrincipal(...)). If the callback runs but never assigns providerBuilder.Credential, the extension throws InvalidOperationException with diagnostic code ASPIRERADIUS010, because the Radius Azure cloud provider cannot be synthesized without a credential.","triggerScenarios":"Calling .WithAzureProvider(subscriptionId, resourceGroup, configure) where the configure callback either has an empty body, only sets other properties, or uses a condition that skips every With* credential method, leaving AzureRadiusProviderBuilder.Credential null.","commonSituations":"Copy-pasting the WithAzureProvider call from docs but forgetting the callback body; refactoring out a WithServicePrincipal call; conditionally adding credentials at runtime where the condition evaluates false; assuming a default (managed identity) credential exists when none does.","solutions":["Call a credential method such as azure.WithServicePrincipal(...) inside the configure callback.","Ensure the credential assignment is not behind a false condition; make the credential unconditional or fix the condition.","If you truly have no credentials yet, defer calling WithAzureProvider until credentials are available."],"exampleFix":"// before\n.WithAzureProvider(subscriptionId, resourceGroup, azure =>\n{\n    // no credential selected\n})\n// after\n.WithAzureProvider(subscriptionId, resourceGroup, azure =>\n{\n    azure.WithServicePrincipal(clientId, clientSecret, tenantId);\n})","handlingStrategy":"validation","validationCode":"// Ensure credentials are configured before building\nif (string.IsNullOrEmpty(clientId) || string.IsNullOrEmpty(tenantId))\n{\n    throw new InvalidOperationException(\"Azure provider credential values must be set before calling WithAzureProvider\");\n}","typeGuard":null,"tryCatchPattern":"try { builder.AddRadius().WithAzureProvider(sub, rg, azure => azure.WithServicePrincipal(clientId, secret, tenantId)); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"ASPIRERADIUS010\")) { logger.LogError(\"Azure Radius provider configured without a credential\"); throw; }","preventionTips":["Always call exactly one credential method (WithServicePrincipal/WithManagedIdentity) inside the configure callback","Never leave the configure callback body empty or fully conditional","Read credential values from validated configuration before defining the provider"],"tags":["azure","radius","credentials","configuration"],"backgroundTag":"missing-required-config-field","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}