TechnitiumSoftware/DnsServer · warning · ArgumentException

The SSO Scopes cannot have more than 255 entries.

Error message

The SSO Scopes cannot have more than 255 entries.

What it means

Thrown by the SsoScopes setter when the supplied set has more than 255 entries. Note that null or empty sets are allowed (they default to openid/profile/email); the exception only fires for a non-empty set that exceeds the cap. It is an ArgumentException enforcing the configured storage width.

Source

Thrown at DnsServerCore/Auth/AuthManager.cs:1413

                    }
                }

                _ssoMetadataAddress = value;
            }
        }

        public IReadOnlySet<string> SsoScopes
        {
            get { return _ssoScopes; }
            set
            {
                if ((value is null) || (value.Count == 0))
                {
                    value = new HashSet<string>() { "openid", "profile", "email" };
                }
                else if (value.Count > 255)
                {
                    throw new ArgumentException("The SSO Scopes cannot have more than 255 entries.", nameof(SsoScopes));
                }
                else if (!value.Contains("openid") || !value.Contains("profile"))
                {
                    HashSet<string> ssoScopes = new HashSet<string>() { "openid", "profile" };

                    foreach (string scope in value)
                    {
                        if (scope.Length > 255)
                            throw new ArgumentException("The SSO Scope name length cannot be more than 255 chars.", nameof(SsoScopes));

                        ssoScopes.Add(scope);
                    }

                    value = ssoScopes;
                }

                _ssoScopes = value;
            }

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Trim the scope set to only the scopes the application actually needs (typically openid, profile, email, plus a few claims).
2. If you truly need >255 scopes, re-evaluate the design — OIDC token size and IdP limits will usually fail first.
3. Validate count in config-loading code before assigning.

Example fix

// before
authManager.SsoScopes = new HashSet<string>(allScopes);

// after
var scopes = new HashSet<string>(allScopes, StringComparer.OrdinalIgnoreCase);
if (scopes.Count > 255)
    throw new ConfigurationException("SsoScopes must contain <= 255 entries.");
authManager.SsoScopes = scopes;

var scopes = new HashSet<string>(rawScopes ?? Enumerable.Empty<string>(), StringComparer.OrdinalIgnoreCase);
if (scopes.Count > 255)
    throw new ConfigurationException("SsoScopes must contain <= 255 entries.");
authManager.SsoScopes = scopes.Count == 0 ? null : scopes;

try { authManager.SsoScopes = scopes; }
catch (ArgumentException ex) when (ex.ParamName == "SsoScopes" && ex.Message.Contains("entries"))
{ /* report too many scopes */ }

When it happens

Trigger: Assigning AuthManager.SsoScopes = scopes where scopes is a non-empty collection with Count > 255.

Common situations: A misconfigured automation that dumps all available IdP scopes into the request; importing a large scope list from another product; a default config generator that enumerates group/role scopes one-by-one.

Related errors

• The SSO Scope name length cannot be more than 255 chars.
• The SSO Authority URL length cannot be more than 255 chars.
• The SSO Client ID length cannot be more than 255 chars.
• The SSO Client Secret length cannot be more than 255 chars.
• The SSO Metadata Address URL length cannot be more than 255

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/0abcc7cc8396933a. Report an issue: GitHub.