TechnitiumSoftware/DnsServer · warning · ArgumentException

The SSO Metadata Address URL scheme can be 'http' or 'https'

Error message

The SSO Metadata Address URL scheme can be 'http' or 'https' only.

What it means

Thrown by the SsoMetadataAddress setter when the Uri's scheme is neither http nor https (compared lowercased). It is an ArgumentException because the value is a valid Uri but the scheme is not allowed for fetching OIDC metadata. Mirrors the same scheme guard used for SsoAuthority.

Source

Thrown at DnsServerCore/Auth/AuthManager.cs:1394

        public Uri SsoMetadataAddress
        {
            get { return _ssoMetadataAddress; }
            set
            {
                if (value is not null)
                {
                    if (value.OriginalString.Length > 255)
                        throw new ArgumentException("The SSO Metadata Address URL length cannot be more than 255 chars.", nameof(SsoMetadataAddress));

                    switch (value.Scheme.ToLowerInvariant())
                    {
                        case "http":
                        case "https":
                            break;

                        default:
                            throw new ArgumentException("The SSO Metadata Address URL scheme can be 'http' or 'https' only.", nameof(SsoMetadataAddress));
                    }
                }

                _ssoMetadataAddress = value;
            }
        }

        public IReadOnlySet<string> SsoScopes
        {
            get { return _ssoScopes; }
            set
            {
                if ((value is null) || (value.Count == 0))
                {
                    value = new HashSet<string>() { "openid", "profile", "email" };
                }
                else if (value.Count > 255)
                {

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Ensure the metadata URL begins with http:// or https:// (https in production).
2. Re-copy the discovery URL from the IdP admin console and fix the scheme.
3. Validate the scheme in config-loading code before assigning.

Example fix

// before
authManager.SsoMetadataAddress = new Uri(metadataUrl);

// after
var uri = new Uri(metadataUrl);
if (uri.Scheme.Equals("http", StringComparison.OrdinalIgnoreCase) || uri.Scheme.Equals("https", StringComparison.OrdinalIgnoreCase))
    authManager.SsoMetadataAddress = uri;
else
    throw new ConfigurationException("SsoMetadataAddress scheme must be http or https.");

static bool ValidMetadataScheme(string url)
{
    if (!Uri.IsWellFormedUriString(url, UriKind.Absolute)) return false;
    var s = new Uri(url).Scheme.ToLowerInvariant();
    return s == "http" || s == "https";
}

if (!ValidMetadataScheme(metadataUrl))
    throw new ConfigurationException("SsoMetadataAddress scheme must be http or https.");
authManager.SsoMetadataAddress = new Uri(metadataUrl);

try { authManager.SsoMetadataAddress = new Uri(metadataUrl); }
catch (ArgumentException ex) when (ex.ParamName == "SsoMetadataAddress")
{ /* report invalid scheme */ }

When it happens

Trigger: Assigning SsoMetadataAddress a Uri with a non-web scheme (ftp, file, ldap, etc.) or a malformed/relative value that parsed to an unexpected scheme.

Common situations: Copy-paste from a config that used a non-web protocol; a file:// path used during local testing; a relative path that Uri did not interpret as https.

Related errors

• The SSO Authority URL scheme can be 'http' or 'https' only.
• The SSO Authority URL length cannot be more than 255 chars.
• The SSO Client ID length cannot be more than 255 chars.
• The SSO Client Secret length cannot be more than 255 chars.
• The SSO Metadata Address URL length cannot be more than 255

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/c3840331470c69d3. Report an issue: GitHub.