conductor-oss/conductor · error · IllegalStateException

Azure Foundry credential '{credentialRef}' must contain clie

Error message

Azure Foundry credential '{credentialRef}' must contain client_id, client_secret, and tenant_id

What it means

Error "Azure Foundry credential '{credentialRef}' must contain client_id, client_secret, and tenant_id" thrown in conductor-oss/conductor.

Source

Thrown at agentspan/src/main/java/org/conductoross/conductor/ai/agentspan/runtime/service/AzureFoundryAgentClient.java:335

            case "failed", "expired" -> ConductorAgentState.FAILED;
            case "cancelled" -> ConductorAgentState.CANCELED;
            case "requires_action" -> ConductorAgentState.WAITING;
            default -> ConductorAgentState.RUNNING; // queued, in_progress
        };
    }

    private OAuthTokenProvider buildTokenProvider(ConductorAgentStartRequest request) {
        String credentialRef = request.getCredentialRef();
        if (StringUtils.isBlank(credentialRef)) {
            throw new IllegalArgumentException(
                    "credentialRef is required for Azure Foundry agent requests");
        }
        String clientId = credentialResolutionService.resolve(credentialRef + ".client_id");
        String clientSecret = credentialResolutionService.resolve(credentialRef + ".client_secret");
        String tenantId = credentialResolutionService.resolve(credentialRef + ".tenant_id");

        if (StringUtils.isAnyBlank(clientId, clientSecret, tenantId)) {
            throw new IllegalStateException(
                    "Azure Foundry credential '"
                            + credentialRef
                            + "' must contain client_id, client_secret, and tenant_id");
        }

        String scope =
                StringUtils.defaultIfBlank(
                        rawConfig(request, "scope"),
                        credentialResolutionService.resolve(credentialRef + ".scope"));
        scope = StringUtils.defaultIfBlank(scope, DEFAULT_SCOPE);

        return OAuthTokenProvider.forAzureEntraId(
                httpClient, tenantId, clientId, clientSecret, scope);
    }

    private String resolveEndpoint(ConductorAgentStartRequest request) {
        String endpoint = rawConfig(request, "endpoint");
        if (StringUtils.isBlank(endpoint)) {

View on GitHub (pinned to cf7c3e4a8a)

Solutions

1. Update the referenced credential to include client_id, client_secret, and tenant_id fields for the Azure Foundry service principal.

When it happens

Trigger: Thrown at agentspan/src/main/java/org/conductoross/conductor/ai/agentspan/runtime/service/AzureFoundryAgentClient.java:335 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of conductor-oss/conductor@cf7c3e4a8a (2026-08-14). Data as JSON: /api/errors/72dce5c177fb81c9. Report an issue: GitHub.