elsa-workflows/elsa-core · error · ArgumentException

The subject is required and must not exceed 4096 characters.

Error message

The subject is required and must not exceed 4096 characters.

What it means

A validation guard thrown by NormalizeSubject: the subject claim value supplied for an external identity link is null, empty/whitespace after trimming, or longer than 4096 characters. The subject is the provider-side identity key and must be a non-empty bounded string.

Solutions

1. Ensure the identity token or userinfo response actually contains a non-empty 'sub' claim before linking.
2. Reject upstream providers that issue oversized subjects rather than truncating them.
3. Trim and validate the subject at the boundary before calling the link management service.

When it happens

Trigger: Thrown at src/modules/Elsa.ExternalAuthentication/Services/ExternalIdentityLinkManagementService.cs:244 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of elsa-workflows/elsa-core@fe9217bdfa (2026-09-13). Data as JSON: /api/errors/2528bab196e526fe. Report an issue: GitHub.

Appendix: source

Thrown at src/modules/Elsa.ExternalAuthentication/Services/ExternalIdentityLinkManagementService.cs:244

                targetConnectionKey,
                conflictingLink?.Id,
                conflictingLink?.UserId,
                conflictingLink?.ConnectionKey),
            cancellationToken);
    }

    private static string NormalizeIssuer(string issuer)
    {
        if (!Uri.TryCreate(issuer?.Trim(), UriKind.Absolute, out var uri) || !string.Equals(uri.Scheme, Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase) || !string.IsNullOrEmpty(uri.Query) || !string.IsNullOrEmpty(uri.Fragment))
            throw new ArgumentException("The issuer must be an absolute HTTPS URI without a query or fragment.", nameof(issuer));
        return uri.GetComponents(UriComponents.AbsoluteUri, UriFormat.UriEscaped).TrimEnd('/');
    }

    private static string NormalizeSubject(string subject)
    {
        var normalized = subject?.Trim();
        if (string.IsNullOrEmpty(normalized) || normalized.Length > 4096)
            throw new ArgumentException("The subject is required and must not exceed 4096 characters.", nameof(subject));
        return normalized;
    }

    private static void ValidateTargetTenant(string tenantId)
    {
        ArgumentNullException.ThrowIfNull(tenantId);
        if (string.Equals(tenantId, ConnectionScope.HostTenantId, StringComparison.Ordinal))
            throw new ArgumentException("External identity links require a resolved tenant.", nameof(tenantId));
    }
}

public sealed record ExternalIdentityLinkUser(string Id, string DisplayName);

public abstract record ExternalIdentityLinkPrelinkResult
{
    private ExternalIdentityLinkPrelinkResult() { }
    public sealed record Success(ExternalIdentityLink Link, bool WasCreated) : ExternalIdentityLinkPrelinkResult;
    public sealed record Conflict(ExternalIdentityLink Link) : ExternalIdentityLinkPrelinkResult;

View on GitHub (pinned to fe9217bdfa)