function Resolve-ConfigurationDataSecretReference {
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory=$true)]
        [System.Collections.IDictionary]
        $Reference,

        [Parameter(Mandatory=$true)]
        [ValidateSet("credential", "securestring", "string")]
        [string]
        $ExpectedType,

        [Parameter(Mandatory=$false)]
        [hashtable]
        $ProviderSettings = @{}
    )

    $Provider = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Provider")
    $ProviderDefinition = Get-ConfigurationDataSecretProvider -Name $Provider

    if($null -eq $ProviderDefinition){
        throw "Unsupported secret provider [$Provider]."
    }

    if($ProviderDefinition.SupportedTypes -notcontains $ExpectedType.ToLowerInvariant()){
        throw "Secret provider [$($ProviderDefinition.Name)] does not support type [$ExpectedType]."
    }

    $CurrentProviderSettings = @{}
    if($ProviderSettings.ContainsKey($ProviderDefinition.Name)){
        $CurrentProviderSettings = $ProviderSettings[$ProviderDefinition.Name]
    }

    return & $ProviderDefinition.Resolver -Reference $Reference -ExpectedType $ExpectedType -ProviderSettings $CurrentProviderSettings
}