{"record":{"id":"ee55a45b1b265f39","repo":"microsoft/aspire","slug":"aspireradius085","errorCode":"ASPIRERADIUS085","errorMessage":"A password was supplied for '${resource.Name}', but the Radius recipe that provisions it deploys the workload without authentication: ${reason}. The parameter '${passwordParameter.Name}' cannot be applied, so '${resource.Name}' would be deployed unauthenticated while its consumers are handed an empty password. Remove the password to accept an unauthenticated deployment, or provision '${resource.Name}' yourself if the deployed workload must require one. Diagnostic: ASPIRERADIUS085.","messagePattern":"A password was supplied for '(.+?)', but the Radius recipe that provisions it deploys the workload without authentication: (.+?)\\. The parameter '(.+?)' cannot be applied, so '(.+?)' would be deployed unauthenticated while its consumers are handed an empty password\\. Remove the password to accept an unauthenticated deployment, or provision '(.+?)' yourself if the deployed workload must require one\\. Diagnostic: ASPIRERADIUS085\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Publishing/RadiusInfrastructureBuilder.cs","lineNumber":2227,"sourceCode":"    /// </para>\n    /// </remarks>\n    private void ApplyNoCredential(\n        IResource resource,\n        IResourceWithConnectionString withConnectionString,\n        string reason)\n    {\n        if (TryGetCredentialParameter(withConnectionString, \"password\") is not { } passwordParameter)\n        {\n            return;\n        }\n\n        // `Default is GenerateParameterDefault` distinguishes the two only in publish mode:\n        // ParameterResourceBuilderExtensions.CreateGeneratedParameter rewrites Default to an\n        // internal user-secrets wrapper in run mode. This code only ever runs while publishing —\n        // the same caveat WarnIfUserSuppliedCredentialIsReplaced documents.\n        if (passwordParameter.Default is not GenerateParameterDefault)\n        {\n            throw new InvalidOperationException(\n                $\"A password was supplied for '{resource.Name}', but the Radius recipe that provisions it deploys the \" +\n                $\"workload without authentication: {reason}. The parameter '{passwordParameter.Name}' cannot be \" +\n                $\"applied, so '{resource.Name}' would be deployed unauthenticated while its consumers are handed an \" +\n                $\"empty password. Remove the password to accept an unauthenticated deployment, or provision \" +\n                $\"'{resource.Name}' yourself if the deployed workload must require one. Diagnostic: ASPIRERADIUS085.\");\n        }\n\n        // Registered as a substitution even though the replacement is a literal: the parameter's own\n        // value is discarded everywhere it appears, so sharing it with a resource that keeps its\n        // value is the same silent-mismatch hazard RegisterRecipeCredential exists to reject.\n        //\n        // WarnIfUserSuppliedCredentialIsReplaced is deliberately not reused here: its message says\n        // the recipe generates its own credential, which is the opposite of what happens for this\n        // mode. The warning below covers the generated password that reaches this point — a\n        // user-supplied one has already failed the publish above — because unlike a substituted\n        // credential it has no deployed counterpart.\n        RegisterRecipeCredential(passwordParameter, resource, isProjectionSubstitution: true);\n        _emptyCredentialSubstitutions.Add(passwordParameter);","sourceCodeStart":2209,"sourceCodeEnd":2245,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Publishing/RadiusInfrastructureBuilder.cs#L2209-L2245","documentation":"A user-supplied password parameter was attached to a resource, but the Radius recipe provisions that resource without authentication, so the password cannot be applied: the workload would deploy unauthenticated while consumers are handed an empty password. This only runs in publish mode; the check relies on Default not being GenerateParameterDefault (run mode rewrites generated defaults to user-secrets wrappers).","triggerScenarios":"Publishing a resource backed by a recipe that deploys without auth while the resource's password ParameterResource has an explicit/default user-supplied value (Default is not GenerateParameterDefault).","commonSituations":"Supplying a password via configuration/parameters for a resource type whose recipe ignores authentication; running publish with a password that only ever applied in run mode; switching resource kinds to one whose recipe does not support auth.","solutions":["Remove the supplied password so the unauthenticated deployment is accepted knowingly.","Provision the resource yourself (outside the recipe) if the deployed workload must require a password.","Switch to a resource configuration whose recipe supports authentication."],"exampleFix":"// before\nvar password = builder.AddParameter(\"redis-password\");\nvar redis = builder.AddRedis(\"cache\").WithPassword(password);\n// after\nvar redis = builder.AddRedis(\"cache\"); // accept recipe's unauthenticated deployment","handlingStrategy":"validation","validationCode":"if (passwordParameter.Default is not GenerateParameterDefault && recipeDeploysWithoutAuth) throw new InvalidOperationException($\"Password for '{resource.Name}' cannot be applied: recipe deploys without authentication.\");","typeGuard":"bool IsUserSuppliedPassword(ParameterResource p) => p.Default is not GenerateParameterDefault;","tryCatchPattern":"try { await PublishAsync(model); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"ASPIRERADIUS085\")) { /* drop the password or provision the resource yourself */ }","preventionTips":["Only supply passwords to resource kinds whose recipes deploy with authentication.","Distinguish run-mode generated parameters from user-supplied ones before publishing.","Provision authenticated resources yourself instead of relying on recipes that ignore auth."],"tags":["radius","publish","password","recipes","authentication"],"backgroundTag":"conflicting-config-options","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}