microsoft/aspire · error · RadiusBackingResourceProjectionException

ASPIRERADIUS082

ASPIRERADIUS082

Error message

Resource '{resource.Name}' would be deployed with the user name 'guest', which RabbitMQ restricts to loopback connections — the deployed broker would reject every workload that connects to it. Supply an explicit user name, for example AddRabbitMQ("{resource.Name}", userName: builder.AddParameter("{resource.Name}user")), so the same value is both provisioned on the broker and composed into the connection string. Diagnostic: ASPIRERADIUS082.

What it means

While writing the deploy parameters file, WriteDeployParametersFileAsync resolves each parameter value and throws this error if a parameter known to be a RabbitMQ user name resolves to the literal 'guest'. RabbitMQ restricts 'guest' to loopback connections, so a broker deployed with that user name would reject every remote workload. The guard (diagnostic ASPIRERADIUS082) fails fast at publish time and tells you to supply an explicit parameterized user name via AddRabbitMQ.

Solutions

Pass an explicit userName parameter to AddRabbitMQ and set a non-'guest' value for it (e.g., via builder.AddParameter with a default or prompt)
Change the parameter's resolved value (appsettings, environment variable, or .env) from 'guest' to a real user name
Ensure the same parameter feeds both the broker provisioning and the connection string so credentials stay in sync
If 'guest' is intentional for local-only use, exclude that resource from Radius deployment or document a deployment-specific credential

Example fix

// before
var rabbit = builder.AddRabbitMQ("messaging");

// after
var rabbitUser = builder.AddParameter("messaginguser");
var rabbitPassword = builder.AddParameter("messagingpassword", secret: true);
var rabbit = builder.AddRabbitMQ("messaging", userName: rabbitUser, password: rabbitPassword);

Defensive patterns

Strategy: validation

Validate before calling

// Ensure the RabbitMQ user-name parameter never resolves to 'guest'
var rabbitUser = builder.AddParameter("messaginguser");
// Fail fast in local checks:
var value = await rabbitUser.GetValueAsync(ct);
if (value == "guest") throw new InvalidOperationException("RabbitMQ user name must not be 'guest' for Radius deployment.");

Type guard

bool IsDeployableRabbitUserName(string? v) => !string.IsNullOrEmpty(v) && v != "guest";

Try / catch

try
{
    await step.ExecuteAsync(context, ct);
}
catch (Exception ex) when (ex.Message.Contains("ASPIRERADIUS082"))
{
    logger.LogError("Replace the 'guest' RabbitMQ user name with an explicit parameter before deploying.");
    throw;
}

Prevention

Always pass an explicit userName parameter to AddRabbitMQ
Never use RabbitMQ's default 'guest' account outside localhost testing
Wire the same parameter into connection strings so provisioned and consumed credentials match

When it happens

Trigger: Running the Radius deployment step where a parameter identified as a RabbitMQ resource's user name (via rabbitMqUserNames tracking) resolves to "guest" — e.g., AddRabbitMQ called without a userName argument or with a parameter whose default value is the literal 'guest'.

Common situations: Using the default parameter value for the RabbitMQ user name; an appsettings/environment value supplying 'guest'; copying a sample that hard-codes 'guest'; generating Bicep for an existing app where the connection string uses guest/ guest locally.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/d89e303b8aec0733. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Publishing/RadiusDeploymentPipelineStep.cs:685

        var annotation = annotations.Last();
        var parameters = annotation.Parameters;
        var rabbitMqUserNames = annotation.RabbitMqUserNames;
        if (parameters.Count == 0)
        {
            return null;
        }

        // ARM JSON deployment parameter file:
        //   { "$schema": "...", "contentVersion": "1.0.0.0",
        //     "parameters": { "<bicepParam>": { "value": "<resolved>" } } }
        var parametersNode = new JsonObject();
        foreach (var (identifier, parameter) in parameters)
        {
            var value = await parameter.GetValueAsync(cancellationToken).ConfigureAwait(false) ?? string.Empty;
            if (rabbitMqUserNames.TryGetValue(parameter, out var rabbitMqOwners) &&
                string.Equals(value, "guest", StringComparison.Ordinal))
            {
                throw RadiusInfrastructureBuilder.CreateRabbitMqGuestUserNameException(rabbitMqOwners[0]);
            }

            parametersNode[identifier] = new JsonObject { ["value"] = value };
        }

        var document = new JsonObject
        {
            ["$schema"] = "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
            ["contentVersion"] = "1.0.0.0",
            ["parameters"] = parametersNode,
        };

        // CreateTempSubdirectory creates the directory with owner-only permissions (0700) on Unix.
        var directory = Directory.CreateTempSubdirectory("radius-deploy-");
        var filePath = Path.Combine(directory.FullName, "parameters.json");
        try
        {
            await File.WriteAllTextAsync(

View on GitHub (pinned to 25830f84bd)