TechnitiumSoftware/DnsServer · warning · ArgumentException

The SSO Client ID length cannot be more than 255 chars.

Error message

The SSO Client ID length cannot be more than 255 chars.

What it means

Thrown by the SsoClientId setter when a non-empty value longer than 255 characters is supplied. Empty strings are normalized to null (disabling the field), so only an over-long non-empty value triggers it. It is an ArgumentException because the value exceeds the configured storage width.

Source

Thrown at DnsServerCore/Auth/AuthManager.cs:1353

                            throw new ArgumentException("The SSO Authority URL scheme can be 'http' or 'https' only.", nameof(SsoAuthority));
                    }
                }

                _ssoAuthority = value;
            }
        }

        public string SsoClientId
        {
            get { return _ssoClientId; }
            set
            {
                if (value is not null)
                {
                    if (value.Length == 0)
                        value = null;
                    else if (value.Length > 255)
                        throw new ArgumentException("The SSO Client ID length cannot be more than 255 chars.", nameof(SsoClientId));
                }

                _ssoClientId = value;
            }
        }

        public string SsoClientSecret
        {
            get { return _ssoClientSecret; }
            set
            {
                if (value is not null)
                {
                    if (value.Length == 0)
                        value = null;
                    else if (value.Length > 255)
                        throw new ArgumentException("The SSO Client Secret length cannot be more than 255 chars.", nameof(SsoClientSecret));
                }

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Verify you copied the OIDC Client ID (not the secret) and that it is within 255 chars.
2. Re-register the app at the IdP if the issued client id is genuinely too long, or check for trailing whitespace.
3. Validate length in config-loading code.

Example fix

// before
authManager.SsoClientId = clientId;

// after
authManager.SsoClientId = string.IsNullOrEmpty(clientId) || clientId.Length > 255
    ? throw new ConfigurationException("SsoClientId must be 1..255 chars.")
    : clientId;

static bool ValidSsoClientId(string id) =>
    string.IsNullOrEmpty(id) || id.Length <= 255;

if (!ValidSsoClientId(clientId))
    throw new ConfigurationException("SsoClientId must be 1..255 chars.");
authManager.SsoClientId = clientId;

try { authManager.SsoClientId = clientId; }
catch (ArgumentException ex) when (ex.ParamName == "SsoClientId")
{ /* report invalid client id length */ }

When it happens

Trigger: Assigning AuthManager.SsoClientId = clientId where clientId is longer than 255 chars (and not empty).

Common situations: Pasting a client secret or certificate thumbprint into the Client ID field by mistake; a misconfigured provisioning script that injects a long token; an IdP that issues unusually long client identifiers.

Related errors

• The SSO Authority URL length cannot be more than 255 chars.
• The SSO Client Secret length cannot be more than 255 chars.
• The SSO Metadata Address URL length cannot be more than 255
• The SSO Scopes cannot have more than 255 entries.
• The SSO Scope name length cannot be more than 255 chars.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/2345b48e01be5f7f. Report an issue: GitHub.