TechnitiumSoftware/DnsServer · warning · ArgumentException

The SSO Authority URL scheme can be 'http' or 'https' only.

Error message

The SSO Authority URL scheme can be 'http' or 'https' only.

What it means

Thrown by the SsoAuthority setter when the Uri's scheme is neither http nor https (lowercased before comparison). It is an ArgumentException because the value type is valid Uri but the scheme is not permitted for an OIDC authority. Only standard web schemes are accepted so the OIDC client does not attempt an unsupported transport.

Source

Thrown at DnsServerCore/Auth/AuthManager.cs:1335

        public Uri SsoAuthority
        {
            get { return _ssoAuthority; }
            set
            {
                if (value is not null)
                {
                    if (value.OriginalString.Length > 255)
                        throw new ArgumentException("The SSO Authority URL length cannot be more than 255 chars.", nameof(SsoAuthority));

                    switch (value.Scheme.ToLowerInvariant())
                    {
                        case "http":
                        case "https":
                            break;

                        default:
                            throw new ArgumentException("The SSO Authority URL scheme can be 'http' or 'https' only.", nameof(SsoAuthority));
                    }
                }

                _ssoAuthority = value;
            }
        }

        public string SsoClientId
        {
            get { return _ssoClientId; }
            set
            {
                if (value is not null)
                {
                    if (value.Length == 0)
                        value = null;
                    else if (value.Length > 255)
                        throw new ArgumentException("The SSO Client ID length cannot be more than 255 chars.", nameof(SsoClientId));

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Ensure the authority URL starts with http:// or https:// (https recommended for production).
2. Re-check the copied value against the IdP documentation and fix the scheme.
3. Validate the scheme in config-loading code before assigning.

Example fix

// before
authManager.SsoAuthority = new Uri(authorityUrl);

// after
var uri = new Uri(authorityUrl);
if (uri.Scheme.Equals("http", StringComparison.OrdinalIgnoreCase) || uri.Scheme.Equals("https", StringComparison.OrdinalIgnoreCase))
    authManager.SsoAuthority = uri;
else
    throw new ConfigurationException("SsoAuthority scheme must be http or https.");

static bool ValidSsoScheme(string url)
{
    if (!Uri.IsWellFormedUriString(url, UriKind.Absolute)) return false;
    var s = new Uri(url).Scheme.ToLowerInvariant();
    return s == "http" || s == "https";
}

if (!ValidSsoScheme(authorityUrl))
    throw new ConfigurationException("SsoAuthority scheme must be http or https.");
authManager.SsoAuthority = new Uri(authorityUrl);

try { authManager.SsoAuthority = new Uri(authorityUrl); }
catch (ArgumentException ex) when (ex.ParamName == "SsoAuthority")
{ /* report invalid scheme */ }

When it happens

Trigger: Assigning SsoAuthority a Uri whose Scheme is e.g. ftp, file, ldap, or a custom scheme; or a relative/malformed string that Uri parsed with an unexpected scheme.

Common situations: Pasting an ldaps:// or ftp:// endpoint by mistake; using a bare host without https:// so Uri infers a relative/odd scheme; misconfigured reverse-proxy URL copied from a config that used a non-web protocol.

Related errors

• The SSO Metadata Address URL scheme can be 'http' or 'https'
• The SSO Authority URL length cannot be more than 255 chars.
• The SSO Client ID length cannot be more than 255 chars.
• The SSO Client Secret length cannot be more than 255 chars.
• The SSO Metadata Address URL length cannot be more than 255

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/9f458ed11e7a29cd. Report an issue: GitHub.