TechnitiumSoftware/DnsServer · warning · ArgumentException

The SSO Client Secret length cannot be more than 255 chars.

Error message

The SSO Client Secret length cannot be more than 255 chars.

What it means

Thrown by the SsoClientSecret setter when a non-empty secret longer than 255 characters is supplied. Empty strings are normalized to null, so only an over-long non-empty secret triggers it. It is an ArgumentException enforcing the configured storage width for the secret field.

Source

Thrown at DnsServerCore/Auth/AuthManager.cs:1370

                    else if (value.Length > 255)
                        throw new ArgumentException("The SSO Client ID length cannot be more than 255 chars.", nameof(SsoClientId));
                }

                _ssoClientId = value;
            }
        }

        public string SsoClientSecret
        {
            get { return _ssoClientSecret; }
            set
            {
                if (value is not null)
                {
                    if (value.Length == 0)
                        value = null;
                    else if (value.Length > 255)
                        throw new ArgumentException("The SSO Client Secret length cannot be more than 255 chars.", nameof(SsoClientSecret));
                }

                _ssoClientSecret = value;
            }
        }

        public Uri SsoMetadataAddress
        {
            get { return _ssoMetadataAddress; }
            set
            {
                if (value is not null)
                {
                    if (value.OriginalString.Length > 255)
                        throw new ArgumentException("The SSO Metadata Address URL length cannot be more than 255 chars.", nameof(SsoMetadataAddress));

                    switch (value.Scheme.ToLowerInvariant())
                    {

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Confirm you are using the exact OIDC client secret registered at the IdP and trim whitespace/newlines.
2. If the secret is genuinely >255 chars, rotate it for a shorter one or check whether a token/cert was pasted by mistake.
3. Validate length in config-loading code.

Example fix

// before
authManager.SsoClientSecret = secret;

// after
authManager.SsoClientSecret = string.IsNullOrEmpty(secret) || secret.Length > 255
    ? throw new ConfigurationException("SsoClientSecret must be 1..255 chars.")
    : secret.Trim();

static bool ValidSsoClientSecret(string s) =>
    string.IsNullOrEmpty(s) || s.Length <= 255;

var secret = clientSecret?.Trim('\n', '\r', ' ');
if (!ValidSsoClientSecret(secret))
    throw new ConfigurationException("SsoClientSecret must be 1..255 chars.");
authManager.SsoClientSecret = secret;

try { authManager.SsoClientSecret = secret; }
catch (ArgumentException ex) when (ex.ParamName == "SsoClientSecret")
{ /* report invalid secret length */ }

When it happens

Trigger: Assigning AuthManager.SsoClientSecret = secret where secret is longer than 255 chars (and not empty).

Common situations: Pasting a full JWKS/certificate or a concatenated secret bundle instead of the registered client secret; an IdP that issues very long shared secrets; trailing newline copied from a secrets manager.

Related errors

• The SSO Authority URL length cannot be more than 255 chars.
• The SSO Client ID length cannot be more than 255 chars.
• The SSO Metadata Address URL length cannot be more than 255
• The SSO Scopes cannot have more than 255 entries.
• The SSO Scope name length cannot be more than 255 chars.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/8b7e170e79b4a1c2. Report an issue: GitHub.