{"record":{"id":"f037c04641fffd23","repo":"microsoft/aspire","slug":"aspireradius040","errorCode":"ASPIRERADIUS040","errorMessage":"Secret store '{store.Name}' of type '{store.Type.ToRadiusTypeString()}' is missing the required key '{required}'. Diagnostic: ASPIRERADIUS040.","messagePattern":"Secret store '(.+?)' of type '(.+?)' is missing the required key '(.+?)'\\. Diagnostic: ASPIRERADIUS040\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs","lineNumber":158,"sourceCode":"        {\n            var seen = new HashSet<string>(StringComparer.Ordinal);\n            foreach (var key in population.Keys)\n            {\n                if (!seen.Add(key))\n                {\n                    throw new InvalidOperationException(\n                        $\"Secret store '{store.Name}' declares the key '{key}' more than once. \" +\n                        \"Diagnostic: ASPIRERADIUS043.\");\n                }\n            }\n        }\n\n        // ASPIRERADIUS040 — type-aware required keys.\n        foreach (var required in store.Type.RequiredKeys())\n        {\n            if (!declaredKeys.Contains(required, StringComparer.Ordinal))\n            {\n                throw new InvalidOperationException(\n                    $\"Secret store '{store.Name}' of type '{store.Type.ToRadiusTypeString()}' is missing \" +\n                    $\"the required key '{required}'. Diagnostic: ASPIRERADIUS040.\");\n            }\n        }\n\n        // ASPIRERADIUS042 / ASPIRERADIUS047 — inline bindings must be secret and use valid encoding.\n        if (population.HasInlineData)\n        {\n            foreach (var (key, binding) in population.Data)\n            {\n                if (!binding.Parameter.Secret)\n                {\n                    throw new InvalidOperationException(\n                        $\"Secret store '{store.Name}' binds key '{key}' to the non-secret parameter \" +\n                        $\"'{binding.Parameter.Name}'. Bind a parameter created with secret: true. \" +\n                        \"Diagnostic: ASPIRERADIUS042.\");\n                }\n","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs#L140-L176","documentation":"ASPIRERADIUS040 enforces type-aware required keys: each RadiusSecretStoreType has a set of keys Radius requires (e.g. certificate needs 'tls.crt' and 'tls.key'); RequiredKeys() returns them and ValidateStore throws when a required key is missing from the declared key set. Generic stores require none.","triggerScenarios":"Declaring a store of type Certificate or BasicAuthentication (or AzureWorkloadIdentity/AwsIrsa) but not declaring its required keys — e.g. a certificate store without 'tls.crt'/'tls.key' — then validating.","commonSituations":"Using a specialized store type while populating it as if it were generic; renaming keys away from the Radius-required literals; partial migration from a generic store sample.","solutions":["Add the missing required key literal exactly (see RequiredKeys(), e.g. 'tls.crt' and 'tls.key' for Certificate).","Switch the store type to Generic if you do not intend to provide the specialized keys.","Check RequiredKeys() for your store.Type and make your population code emit all of them."],"exampleFix":"// before\nvar store = builder.AddRadiusSecretStore(\"cert\", type: RadiusSecretStoreType.Certificate)\n    .WithData();\nstore.WithData().Add(\"tls.crt\", crtParam);\n// after\nstore.WithData().Add(\"tls.crt\", crtParam).Add(\"tls.key\", keyParam);","handlingStrategy":"validation","validationCode":"foreach (var required in store.Type.RequiredKeys())\n    if (!declaredKeys.Contains(required, StringComparer.Ordinal))\n        throw new InvalidOperationException($\"{store.Name} missing required key {required}\");","typeGuard":null,"tryCatchPattern":"try { /* validation runs */ }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"ASPIRERADIUS040\")) { /* add the missing required key */ }","preventionTips":["Consult store.Type.RequiredKeys() and emit every literal it returns","Use Generic type when you don't intend to supply specialized keys","Keep key names exactly as Radius expects ('tls.crt', 'tls.key', etc.)"],"tags":["validation","radius","required-keys"],"backgroundTag":"missing-required-config-field","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}