microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS047

ASPIRERADIUS047

Error message

Secret store '{store.Name}' sets encoding '{binding.Encoding}' on key '{key}', which is invalid for a '{store.Type.ToRadiusTypeString()}' store. Diagnostic: ASPIRERADIUS047.

What it means

This error is thrown during Radius secret store validation (ASPIRERADIUS047) when a store binding sets an 'encoding' value that the store's type does not permit. Each Radius secret store type (e.g. basicAuthentication vs generic) accepts only a subset of encodings; setting an unsupported one would produce a Bicep/Radius manifest that Radius would reject or silently mishandle, so the validator fails fast at build time. The check runs in ValidateStore over every binding of the store.

Solutions

Remove the Encoding setting from the offending binding if it is not needed.
Check which encodings the store's RadiusSecretStoreType permits and set one of those on the binding.
Change the store type (e.g. to a generic store) if the binding genuinely requires the encoding you specified.

Example fix

// before
var store = radius.AddSecretStore("secrets", t => t.WithType(RadiusSecretStoreType.BasicAuthentication))
    .WithBinding("password", encoding: "base64");

// after
var store = radius.AddSecretStore("secrets", t => t.WithType(RadiusSecretStoreType.BasicAuthentication))
    .WithBinding("password"); // encoding omitted: not valid for basicAuthentication stores

Defensive patterns

Strategy: validation

Validate before calling

// Before configuring bindings, check encodings against the store type.
bool IsValidForStore(RadiusSecretStoreType type, string? encoding) =>
    encoding is null || type.IsValidEncoding(encoding);

Type guard

if (binding.Encoding is not null && !store.Type.IsValidEncoding(binding.Encoding)) throw new InvalidOperationException($"Encoding '{binding.Encoding}' invalid for {store.Type}.");

Prevention

Only set Encoding on bindings when the store type's documentation lists it as valid.
Centralize store-type/binding creation in one helper so type/encoding pairings are checked once.
Run Radius secret store validation early in tests before deployment.

When it happens

Trigger: Calling the secret store binding API with an encoding value that is not in the valid set for the store's RadiusSecretStoreType — e.g. building a store whose type is BasicAuthentication but setting binding.Encoding to an encoding only valid for generic stores (or any unknown encoding string). Any call to RadiusSecretStoreValidation.Validate that encounters a binding where binding.Encoding is not null and !store.Type.IsValidEncoding(binding.Encoding).

Common situations: Copy-pasting a secret store configuration between store types; changing store.Type (e.g. from generic to basicAuthentication) after bindings were configured with encodings; hand-writing encoding strings that are misspelled or made up rather than taken from the allowed enum list.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/b6e7d55867a988b3. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs:179

            }
        }

        // ASPIRERADIUS042 / ASPIRERADIUS047 — inline bindings must be secret and use valid encoding.
        if (population.HasInlineData)
        {
            foreach (var (key, binding) in population.Data)
            {
                if (!binding.Parameter.Secret)
                {
                    throw new InvalidOperationException(
                        $"Secret store '{store.Name}' binds key '{key}' to the non-secret parameter " +
                        $"'{binding.Parameter.Name}'. Bind a parameter created with secret: true. " +
                        "Diagnostic: ASPIRERADIUS042.");
                }

                if (binding.Encoding is not null && !store.Type.IsValidEncoding(binding.Encoding))
                {
                    throw new InvalidOperationException(
                        $"Secret store '{store.Name}' sets encoding '{binding.Encoding}' on key '{key}', which is " +
                        $"invalid for a '{store.Type.ToRadiusTypeString()}' store. Diagnostic: ASPIRERADIUS047.");
                }
            }
        }

        // ASPIRERADIUS062 — WithMaterializationTimeout only affects the sealed-secret deploy path,
        // which awaits the SealedSecret controller. On any other population mode it would silently
        // no-op, so reject an explicit override rather than mislead the author.
        if (store.MaterializationTimeoutWasSet && !population.HasSealedSecret)
        {
            throw new InvalidOperationException(
                $"Secret store '{store.Name}' sets WithMaterializationTimeout but is not populated with " +
                "WithSealedSecret. The materialization timeout only applies to sealed secrets; remove the " +
                "call or use WithSealedSecret. Diagnostic: ASPIRERADIUS062.");
        }

        // ASPIRERADIUS055 — an application-scoped existing-secret store has no single owning environment,

View on GitHub (pinned to 25830f84bd)