TechnitiumSoftware/DnsServer · warning · ArgumentException

The SSO Group Map cannot have more than 255 entries.

Error message

The SSO Group Map cannot have more than 255 entries.

What it means

Thrown by the SsoGroupMap setter when the supplied dictionary has more than 255 entries. Empty dictionaries are normalized to null, so only a non-empty map exceeding the cap triggers it. It is an ArgumentException enforcing the configured storage width for the IdP-to-local group mapping.

Source

Thrown at DnsServerCore/Auth/AuthManager.cs:1456

        }

        public bool SsoAllowSignupOnlyForMappedUsers
        {
            get { return _ssoAllowSignupOnlyForMappedUsers; }
            set { _ssoAllowSignupOnlyForMappedUsers = value; }
        }

        public IReadOnlyDictionary<string, string> SsoGroupMap
        {
            get { return _ssoGroupMap; }
            set
            {
                if (value is not null)
                {
                    if (value.Count == 0)
                        value = null;
                    else if (value.Count > 255)
                        throw new ArgumentException("The SSO Group Map cannot have more than 255 entries.", nameof(SsoGroupMap));
                }

                _ssoGroupMap = value;
            }
        }

        public bool SsoManagedGroups
        { get { return _ssoGroupMap is not null; } }

        #endregion
    }
}

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Map only the IdP groups you actually need to local groups (usually a small handful).
2. Dedupe and consolidate equivalent groups before assigning.
3. Validate count in config-loading code before assigning.

Example fix

// before
authManager.SsoGroupMap = groupMap;

// after
var map = groupMap.Where(kv => !string.IsNullOrWhiteSpace(kv.Key)).Take(255).ToDictionary(kv => kv.Key, kv => kv.Value);
authManager.SsoGroupMap = map.Count == 0 ? null : map;

var map = (rawMap ?? new Dictionary<string,string>())
    .Where(kv => !string.IsNullOrWhiteSpace(kv.Key))
    .GroupBy(kv => kv.Key, StringComparer.OrdinalIgnoreCase)
    .ToDictionary(g => g.Key, g => g.First().Value);
if (map.Count > 255)
    throw new ConfigurationException("SsoGroupMap must contain <= 255 entries.");
authManager.SsoGroupMap = map.Count == 0 ? null : map;

try { authManager.SsoGroupMap = groupMap; }
catch (ArgumentException ex) when (ex.ParamName == "SsoGroupMap")
{ /* report too many entries */ }

When it happens

Trigger: Assigning AuthManager.SsoGroupMap = map where map is a non-empty dictionary with Count > 255.

Common situations: Auto-generating a group map from every IdP group; importing a large directory's group list; a config builder that maps each claim value to a local group without deduping.

Related errors

• The SSO Authority URL length cannot be more than 255 chars.
• The SSO Client ID length cannot be more than 255 chars.
• The SSO Client Secret length cannot be more than 255 chars.
• The SSO Metadata Address URL length cannot be more than 255
• The SSO Scopes cannot have more than 255 entries.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/b741e86c82a4c50f. Report an issue: GitHub.