TechnitiumSoftware/DnsServer · error · InvalidOperationException

Cannot add user to group: user can be member of max 255 grou

Error message

Cannot add user to group: user can be member of max 255 groups.

What it means

Thrown by User.AddToGroup(group) when _memberOfGroups already holds 255 entries. The limit exists because the group count is persisted as a single byte in WriteTo (bW.Write(Convert.ToByte(_memberOfGroups.Count))), so a 256th group would overflow serialization. The guard prevents silent truncation/corruption on save.

Source

Thrown at DnsServerCore/Auth/User.cs:340

            _totpEnabled = false;
        }

        public void LoggedInFrom(IPAddress remoteAddress)
        {
            if (remoteAddress.IsIPv4MappedToIPv6)
                remoteAddress = remoteAddress.MapToIPv4();

            _previousSessionLoggedOn = _recentSessionLoggedOn;
            _previousSessionRemoteAddress = _recentSessionRemoteAddress;

            _recentSessionLoggedOn = DateTime.UtcNow;
            _recentSessionRemoteAddress = remoteAddress;
        }

        public void AddToGroup(Group group)
        {
            if (_memberOfGroups.Count == 255)
                throw new InvalidOperationException("Cannot add user to group: user can be member of max 255 groups.");

            _memberOfGroups.TryAdd(group.Name.ToLowerInvariant(), group);
        }

        public bool RemoveFromGroup(Group group)
        {
            if (group.Name.Equals("everyone", StringComparison.OrdinalIgnoreCase))
                throw new InvalidOperationException("Access was denied.");

            return _memberOfGroups.TryRemove(group.Name.ToLowerInvariant(), out _);
        }

        public void SyncGroups(IReadOnlyDictionary<string, Group> groups)
        {
            //remove non-existent groups
            foreach (KeyValuePair<string, Group> group in _memberOfGroups)
            {
                if (!groups.ContainsKey(group.Key))

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Prune unused or duplicate groups from the user before adding new ones.
2. Consolidate fine-grained groups into broader roles so membership stays well under 255.
3. Check _memberOfGroups.Count before calling AddToGroup and surface a clear error to the administrator.

Example fix

// before
user.AddToGroup(group);

// after
const int MAX = 255;
if (user.GroupCount >= MAX)
    throw new InvalidOperationException($"User already belongs to the maximum of {MAX} groups; remove one first.");
user.AddToGroup(group);

const int MAX_GROUPS = 255;
if (user.GroupCount >= MAX_GROUPS)
    return Conflict($"User is already in the maximum of {MAX_GROUPS} groups.");
user.AddToGroup(group);

static bool CanAddGroup(User user) => user.GroupCount < 255;

When it happens

Trigger: Calling AddToGroup for the 256th time on a single user, e.g. a bulk group-assignment script or a deep role hierarchy that pushes a user over the limit.

Common situations: Auto-provisioning that assigns a user to many fine-grained groups; accumulated stale groups never cleaned up; migration that flattens nested groups into direct memberships.

Related errors

• Access was denied.
• Display name length cannot exceed 255 characters.
• Invalid data or version not supported.
• Group name cannot be null or empty.
• Group name length cannot exceed 255 characters.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/69dd763b14303ea7. Report an issue: GitHub.