TechnitiumSoftware/DnsServer · warning · ArgumentException

The SSO Metadata Address URL length cannot be more than 255

Error message

The SSO Metadata Address URL length cannot be more than 255 chars.

What it means

Thrown by the SsoMetadataAddress setter when the supplied Uri's OriginalString exceeds 255 characters. It is an ArgumentException (parameter SsoMetadataAddress) enforcing the storage width. This is the metadata/well-known endpoint URL, separate from SsoAuthority.

Source

Thrown at DnsServerCore/Auth/AuthManager.cs:1385

                    if (value.Length == 0)
                        value = null;
                    else if (value.Length > 255)
                        throw new ArgumentException("The SSO Client Secret length cannot be more than 255 chars.", nameof(SsoClientSecret));
                }

                _ssoClientSecret = value;
            }
        }

        public Uri SsoMetadataAddress
        {
            get { return _ssoMetadataAddress; }
            set
            {
                if (value is not null)
                {
                    if (value.OriginalString.Length > 255)
                        throw new ArgumentException("The SSO Metadata Address URL length cannot be more than 255 chars.", nameof(SsoMetadataAddress));

                    switch (value.Scheme.ToLowerInvariant())
                    {
                        case "http":
                        case "https":
                            break;

                        default:
                            throw new ArgumentException("The SSO Metadata Address URL scheme can be 'http' or 'https' only.", nameof(SsoMetadataAddress));
                    }
                }

                _ssoMetadataAddress = value;
            }
        }

        public IReadOnlySet<string> SsoScopes
        {

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Use the shortest valid discovery document URL (often the base issuer + /.well-known/openid-configuration).
2. If only the authority is needed, leave metadata unset and rely on SsoAuthority discovery.
3. Validate length in config-loading code before assigning.

Example fix

// before
authManager.SsoMetadataAddress = new Uri(metadataUrl);

// after
if (Uri.IsWellFormedUriString(metadataUrl, UriKind.Absolute) && metadataUrl.Length <= 255)
    authManager.SsoMetadataAddress = new Uri(metadataUrl);
else
    throw new ConfigurationException("SsoMetadataAddress must be an absolute http(s) URL <= 255 chars.");

static bool ValidSsoMetadata(string url) =>
    Uri.IsWellFormedUriString(url, UriKind.Absolute)
    && url.Length <= 255;

if (!ValidSsoMetadata(metadataUrl))
    throw new ConfigurationException("SsoMetadataAddress must be an absolute URL <= 255 chars.");
authManager.SsoMetadataAddress = new Uri(metadataUrl);

try { authManager.SsoMetadataAddress = new Uri(metadataUrl); }
catch (ArgumentException ex) when (ex.ParamName == "SsoMetadataAddress")
{ /* report invalid metadata address */ }

When it happens

Trigger: Assigning AuthManager.SsoMetadataAddress = new Uri(longMetadataUrl) where the URL string is longer than 255 chars.

Common situations: A long IdP well-known discovery URL with tenant/realm/query params; using a metadata URL that embeds a token; a regional/cloud IdP whose metadata path is unusually deep.

Related errors

• The SSO Authority URL length cannot be more than 255 chars.
• The SSO Client ID length cannot be more than 255 chars.
• The SSO Client Secret length cannot be more than 255 chars.
• The SSO Scopes cannot have more than 255 entries.
• The SSO Scope name length cannot be more than 255 chars.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/38f2f973487770a2. Report an issue: GitHub.