TechnitiumSoftware/DnsServer · warning · ArgumentException

The SSO Scope name length cannot be more than 255 chars.

Error message

The SSO Scope name length cannot be more than 255 chars.

What it means

Thrown by the SsoScopes setter, inside the loop that augments the set with openid/profile, when any individual scope string is longer than 255 characters. It is an ArgumentException (parameter SsoScopes) guarding both the per-entry storage width and OIDC validity. It only runs when the set does not already contain openid/profile (i.e. it is being normalized).

Source

Thrown at DnsServerCore/Auth/AuthManager.cs:1422

            get { return _ssoScopes; }
            set
            {
                if ((value is null) || (value.Count == 0))
                {
                    value = new HashSet<string>() { "openid", "profile", "email" };
                }
                else if (value.Count > 255)
                {
                    throw new ArgumentException("The SSO Scopes cannot have more than 255 entries.", nameof(SsoScopes));
                }
                else if (!value.Contains("openid") || !value.Contains("profile"))
                {
                    HashSet<string> ssoScopes = new HashSet<string>() { "openid", "profile" };

                    foreach (string scope in value)
                    {
                        if (scope.Length > 255)
                            throw new ArgumentException("The SSO Scope name length cannot be more than 255 chars.", nameof(SsoScopes));

                        ssoScopes.Add(scope);
                    }

                    value = ssoScopes;
                }

                _ssoScopes = value;
            }
        }

        public bool SsoAllowSignup
        {
            get { return _ssoAllowSignup; }
            set { _ssoAllowSignup = value; }
        }

        public bool SsoAllowSignupOnlyForMappedUsers

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Ensure each entry is a short OIDC scope name (e.g. openid, profile, email, custom-app-scope).
2. Remove any entry that is a URL/full claim path.
3. Validate per-entry length in config-loading code before assigning.

Example fix

// before
authManager.SsoScopes = scopes;

// after
if (scopes.Any(s => s.Length > 255))
    throw new ConfigurationException("Each SSO scope must be <= 255 chars.");
authManager.SsoScopes = scopes;

static bool ValidScopes(IEnumerable<string> scopes) =>
    scopes.All(s => s.Length <= 255);

if (!ValidScopes(rawScopes))
    throw new ConfigurationException("Each SSO scope must be <= 255 chars.");
authManager.SsoScopes = new HashSet<string>(rawScopes);

try { authManager.SsoScopes = scopes; }
catch (ArgumentException ex) when (ex.ParamName == "SsoScopes" && ex.Message.Contains("Scope name length"))
{ /* report over-long scope */ }

When it happens

Trigger: Assigning SsoScopes a set whose normalization branch runs (set lacks openid or profile) AND at least one scope.Length > 255.

Common situations: A scope field accidentally populated with a URL or a long claim string instead of a short scope name; copy-paste of a full claim URI into the scopes list.

Related errors

• The SSO Scopes cannot have more than 255 entries.
• The SSO Authority URL length cannot be more than 255 chars.
• The SSO Client ID length cannot be more than 255 chars.
• The SSO Client Secret length cannot be more than 255 chars.
• The SSO Metadata Address URL length cannot be more than 255

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/e29496cf88fd0062. Report an issue: GitHub.