TechnitiumSoftware/DnsServer · warning · ArgumentException

The SSO Authority URL length cannot be more than 255 chars.

Error message

The SSO Authority URL length cannot be more than 255 chars.

What it means

Thrown by the SsoAuthority property setter when the supplied Uri's OriginalString exceeds 255 characters. It is an ArgumentException (parameter name SsoAuthority) because the input violates a documented length constraint. The 255 limit matches the underlying storage field width, so longer values would be truncated or rejected by the store.

Source

Thrown at DnsServerCore/Auth/AuthManager.cs:1326

        public ICollection<UserSession> Sessions
        { get { return _sessions.Values; } }

        public bool SsoEnabled
        {
            get { return _ssoEnabled; }
            set { _ssoEnabled = value; }
        }

        public Uri SsoAuthority
        {
            get { return _ssoAuthority; }
            set
            {
                if (value is not null)
                {
                    if (value.OriginalString.Length > 255)
                        throw new ArgumentException("The SSO Authority URL length cannot be more than 255 chars.", nameof(SsoAuthority));

                    switch (value.Scheme.ToLowerInvariant())
                    {
                        case "http":
                        case "https":
                            break;

                        default:
                            throw new ArgumentException("The SSO Authority URL scheme can be 'http' or 'https' only.", nameof(SsoAuthority));
                    }
                }

                _ssoAuthority = value;
            }
        }

        public string SsoClientId
        {

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Use the shortest valid authority URL (typically the IdP base/tenant URL without extra query string).
2. If the IdP genuinely requires a long URL, point SsoMetadataAddress at the well-known metadata document instead and keep SsoAuthority short.
3. Validate the URL length in config-loading code before assigning.

Example fix

// before
authManager.SsoAuthority = new Uri(authorityUrl);

// after
if (Uri.IsWellFormedUriString(authorityUrl, UriKind.Absolute) && authorityUrl.Length <= 255)
    authManager.SsoAuthority = new Uri(authorityUrl);
else
    throw new ConfigurationException("SsoAuthority must be an absolute http(s) URL of <= 255 chars.");

static bool ValidSsoAuthority(string url) =>
    Uri.IsWellFormedUriString(url, UriKind.Absolute)
    && url.Length <= 255;

if (!ValidSsoAuthority(authorityUrl))
    throw new ConfigurationException("SsoAuthority must be an absolute URL <= 255 chars.");
authManager.SsoAuthority = new Uri(authorityUrl);

try { authManager.SsoAuthority = new Uri(authorityUrl); }
catch (ArgumentException ex) when (ex.ParamName == "SsoAuthority")
{ /* report invalid SSO authority config */ }

When it happens

Trigger: Assigning AuthManager.SsoAuthority = new Uri(veryLongUrl) where the URL string is longer than 255 chars, while SSO is being configured.

Common situations: An IdP discovery/authority URL padded with query parameters, tenant paths, or trailing slashes that push it past 255; copy-pasting a metadata endpoint instead of the bare authority; deploying SSO config via a UI that does not enforce the limit client-side.

Related errors

• The SSO Client ID length cannot be more than 255 chars.
• The SSO Client Secret length cannot be more than 255 chars.
• The SSO Metadata Address URL length cannot be more than 255
• The SSO Scopes cannot have more than 255 entries.
• The SSO Scope name length cannot be more than 255 chars.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/4f8d1517cd374cb1. Report an issue: GitHub.