elsa-workflows/elsa-core · error · InvalidOperationException

The configured secret binding is invalid.

Error message

The configured secret binding is invalid.

What it means

EnsureType validates that a SecretBinding is actually meant for the Configuration resolver: ResolverType must equal this resolver's Type and Reference must be a non-empty string. Any binding with a mismatched resolver type or missing reference is rejected before resolution.

Solutions

1. Set binding.Reference to the configuration path holding the secret.
2. Set binding.ResolverType to the exact type string registered for the configuration resolver.
3. Inspect the stored connection record for null/empty binding fields produced by migration or manual edits.
4. Confirm the binding is not intended for a different resolver; if so, register/choose that resolver instead.

Example fix

// before
new SecretBinding { ResolverType = "config", Reference = null }
// after
new SecretBinding { ResolverType = "Configuration", Reference = "ExternalAuth:MyIdp:ClientSecret" }

// Validate the binding before handing it to the resolver
bool IsValid(SecretBinding b, string expectedType) =>
    string.Equals(b.ResolverType, expectedType, StringComparison.Ordinal)
    && !string.IsNullOrWhiteSpace(b.Reference);

static bool IsConfigurationBinding(SecretBinding b, string configurationResolverType) =>
    string.Equals(b.ResolverType, configurationResolverType, StringComparison.Ordinal)
    && !string.IsNullOrWhiteSpace(b.Reference);

When it happens

Trigger: Thrown from ResolveAsync/GetStateAsync when the stored SecretBinding.ResolverType does not match the Configuration resolver's type string (e.g. a binding created for another resolver type routed here), or when Reference is null, empty, or whitespace.

Common situations: Hand-written or migrated SecretBinding JSON missing the reference field; a typo in the resolverType value; deserialization producing default/empty binding fields; switching a connection between resolvers without updating the binding.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Configuration connection
• A configuration key is required.
• Capacity must be greater than zero.
• The OpenID Connect connection configuration is invalid.
• The secret field name must contain a letter or digit.

AI-assisted analysis of elsa-workflows/elsa-core@fe9217bdfa (2026-09-13). Data as JSON: /api/errors/33b253ec8c9d7bd8. Report an issue: GitHub.

Appendix: source

Thrown at src/modules/Elsa.ExternalAuthentication/Services/ConfigurationSecretBindingResolver.cs:36

        EnsureType(binding);
        var configured = !string.IsNullOrWhiteSpace(configuration[binding.Reference]);
        return ValueTask.FromResult(new SecretBindingState(configured, configured));
    }

    public ValueTask<ResolvedSecretBinding> ResolveAsync(SecretBinding binding, CancellationToken cancellationToken = default)
    {
        cancellationToken.ThrowIfCancellationRequested();
        EnsureType(binding);
        var value = configuration[binding.Reference];
        if (string.IsNullOrWhiteSpace(value))
            throw new InvalidOperationException("The configured secret binding could not be resolved.");
        return ValueTask.FromResult(new ResolvedSecretBinding(new(value), hasher.Hash($"{ResolverType}:{binding.Reference}:{value}")));
    }

    private static void EnsureType(SecretBinding binding)
    {
        if (!string.Equals(binding.ResolverType, ResolverType, StringComparison.Ordinal) || string.IsNullOrWhiteSpace(binding.Reference))
            throw new InvalidOperationException("The configured secret binding is invalid.");
    }
}

View on GitHub (pinned to fe9217bdfa)