{"record":{"id":"0abcc7cc8396933a","repo":"TechnitiumSoftware/DnsServer","slug":"the-sso-scopes-cannot-have-more-than-255-entries","errorCode":null,"errorMessage":"The SSO Scopes cannot have more than 255 entries.","messagePattern":"The SSO Scopes cannot have more than 255 entries\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"warning","filePath":"DnsServerCore/Auth/AuthManager.cs","lineNumber":1413,"sourceCode":"                    }\n                }\n\n                _ssoMetadataAddress = value;\n            }\n        }\n\n        public IReadOnlySet<string> SsoScopes\n        {\n            get { return _ssoScopes; }\n            set\n            {\n                if ((value is null) || (value.Count == 0))\n                {\n                    value = new HashSet<string>() { \"openid\", \"profile\", \"email\" };\n                }\n                else if (value.Count > 255)\n                {\n                    throw new ArgumentException(\"The SSO Scopes cannot have more than 255 entries.\", nameof(SsoScopes));\n                }\n                else if (!value.Contains(\"openid\") || !value.Contains(\"profile\"))\n                {\n                    HashSet<string> ssoScopes = new HashSet<string>() { \"openid\", \"profile\" };\n\n                    foreach (string scope in value)\n                    {\n                        if (scope.Length > 255)\n                            throw new ArgumentException(\"The SSO Scope name length cannot be more than 255 chars.\", nameof(SsoScopes));\n\n                        ssoScopes.Add(scope);\n                    }\n\n                    value = ssoScopes;\n                }\n\n                _ssoScopes = value;\n            }","sourceCodeStart":1395,"sourceCodeEnd":1431,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/AuthManager.cs#L1395-L1431","documentation":"Thrown by the SsoScopes setter when the supplied set has more than 255 entries. Note that null or empty sets are allowed (they default to openid/profile/email); the exception only fires for a non-empty set that exceeds the cap. It is an ArgumentException enforcing the configured storage width.","triggerScenarios":"Assigning AuthManager.SsoScopes = scopes where scopes is a non-empty collection with Count > 255.","commonSituations":"A misconfigured automation that dumps all available IdP scopes into the request; importing a large scope list from another product; a default config generator that enumerates group/role scopes one-by-one.","solutions":["Trim the scope set to only the scopes the application actually needs (typically openid, profile, email, plus a few claims).","If you truly need >255 scopes, re-evaluate the design — OIDC token size and IdP limits will usually fail first.","Validate count in config-loading code before assigning."],"exampleFix":"// before\nauthManager.SsoScopes = new HashSet<string>(allScopes);\n\n// after\nvar scopes = new HashSet<string>(allScopes, StringComparer.OrdinalIgnoreCase);\nif (scopes.Count > 255)\n    throw new ConfigurationException(\"SsoScopes must contain <= 255 entries.\");\nauthManager.SsoScopes = scopes;","handlingStrategy":"validation","validationCode":"var scopes = new HashSet<string>(rawScopes ?? Enumerable.Empty<string>(), StringComparer.OrdinalIgnoreCase);\nif (scopes.Count > 255)\n    throw new ConfigurationException(\"SsoScopes must contain <= 255 entries.\");\nauthManager.SsoScopes = scopes.Count == 0 ? null : scopes;","typeGuard":null,"tryCatchPattern":"try { authManager.SsoScopes = scopes; }\ncatch (ArgumentException ex) when (ex.ParamName == \"SsoScopes\" && ex.Message.Contains(\"entries\"))\n{ /* report too many scopes */ }","preventionTips":["Request only the scopes the app needs (usually <10).","Dedupe scopes case-insensitively before assigning.","Validate count in the config loader."],"tags":["sso","config","validation","length-limit","oidc-scopes"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}