{"record":{"id":"2345b48e01be5f7f","repo":"TechnitiumSoftware/DnsServer","slug":"the-sso-client-id-length-cannot-be-more-than-255-c","errorCode":null,"errorMessage":"The SSO Client ID length cannot be more than 255 chars.","messagePattern":"The SSO Client ID length cannot be more than 255 chars\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"warning","filePath":"DnsServerCore/Auth/AuthManager.cs","lineNumber":1353,"sourceCode":"                            throw new ArgumentException(\"The SSO Authority URL scheme can be 'http' or 'https' only.\", nameof(SsoAuthority));\n                    }\n                }\n\n                _ssoAuthority = value;\n            }\n        }\n\n        public string SsoClientId\n        {\n            get { return _ssoClientId; }\n            set\n            {\n                if (value is not null)\n                {\n                    if (value.Length == 0)\n                        value = null;\n                    else if (value.Length > 255)\n                        throw new ArgumentException(\"The SSO Client ID length cannot be more than 255 chars.\", nameof(SsoClientId));\n                }\n\n                _ssoClientId = value;\n            }\n        }\n\n        public string SsoClientSecret\n        {\n            get { return _ssoClientSecret; }\n            set\n            {\n                if (value is not null)\n                {\n                    if (value.Length == 0)\n                        value = null;\n                    else if (value.Length > 255)\n                        throw new ArgumentException(\"The SSO Client Secret length cannot be more than 255 chars.\", nameof(SsoClientSecret));\n                }","sourceCodeStart":1335,"sourceCodeEnd":1371,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/AuthManager.cs#L1335-L1371","documentation":"Thrown by the SsoClientId setter when a non-empty value longer than 255 characters is supplied. Empty strings are normalized to null (disabling the field), so only an over-long non-empty value triggers it. It is an ArgumentException because the value exceeds the configured storage width.","triggerScenarios":"Assigning AuthManager.SsoClientId = clientId where clientId is longer than 255 chars (and not empty).","commonSituations":"Pasting a client secret or certificate thumbprint into the Client ID field by mistake; a misconfigured provisioning script that injects a long token; an IdP that issues unusually long client identifiers.","solutions":["Verify you copied the OIDC Client ID (not the secret) and that it is within 255 chars.","Re-register the app at the IdP if the issued client id is genuinely too long, or check for trailing whitespace.","Validate length in config-loading code."],"exampleFix":"// before\nauthManager.SsoClientId = clientId;\n\n// after\nauthManager.SsoClientId = string.IsNullOrEmpty(clientId) || clientId.Length > 255\n    ? throw new ConfigurationException(\"SsoClientId must be 1..255 chars.\")\n    : clientId;","handlingStrategy":"validation","validationCode":"static bool ValidSsoClientId(string id) =>\n    string.IsNullOrEmpty(id) || id.Length <= 255;\n\nif (!ValidSsoClientId(clientId))\n    throw new ConfigurationException(\"SsoClientId must be 1..255 chars.\");\nauthManager.SsoClientId = clientId;","typeGuard":null,"tryCatchPattern":"try { authManager.SsoClientId = clientId; }\ncatch (ArgumentException ex) when (ex.ParamName == \"SsoClientId\")\n{ /* report invalid client id length */ }","preventionTips":["Confirm you copied the OIDC Client ID, not the secret.","Trim whitespace when reading the value from a secrets store.","Enforce the length in the config UI/loader."],"tags":["sso","config","validation","length-limit"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}