{"record":{"id":"38f2f973487770a2","repo":"TechnitiumSoftware/DnsServer","slug":"the-sso-metadata-address-url-length-cannot-be-more","errorCode":null,"errorMessage":"The SSO Metadata Address URL length cannot be more than 255 chars.","messagePattern":"The SSO Metadata Address URL length cannot be more than 255 chars\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"warning","filePath":"DnsServerCore/Auth/AuthManager.cs","lineNumber":1385,"sourceCode":"                    if (value.Length == 0)\n                        value = null;\n                    else if (value.Length > 255)\n                        throw new ArgumentException(\"The SSO Client Secret length cannot be more than 255 chars.\", nameof(SsoClientSecret));\n                }\n\n                _ssoClientSecret = value;\n            }\n        }\n\n        public Uri SsoMetadataAddress\n        {\n            get { return _ssoMetadataAddress; }\n            set\n            {\n                if (value is not null)\n                {\n                    if (value.OriginalString.Length > 255)\n                        throw new ArgumentException(\"The SSO Metadata Address URL length cannot be more than 255 chars.\", nameof(SsoMetadataAddress));\n\n                    switch (value.Scheme.ToLowerInvariant())\n                    {\n                        case \"http\":\n                        case \"https\":\n                            break;\n\n                        default:\n                            throw new ArgumentException(\"The SSO Metadata Address URL scheme can be 'http' or 'https' only.\", nameof(SsoMetadataAddress));\n                    }\n                }\n\n                _ssoMetadataAddress = value;\n            }\n        }\n\n        public IReadOnlySet<string> SsoScopes\n        {","sourceCodeStart":1367,"sourceCodeEnd":1403,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/AuthManager.cs#L1367-L1403","documentation":"Thrown by the SsoMetadataAddress setter when the supplied Uri's OriginalString exceeds 255 characters. It is an ArgumentException (parameter SsoMetadataAddress) enforcing the storage width. This is the metadata/well-known endpoint URL, separate from SsoAuthority.","triggerScenarios":"Assigning AuthManager.SsoMetadataAddress = new Uri(longMetadataUrl) where the URL string is longer than 255 chars.","commonSituations":"A long IdP well-known discovery URL with tenant/realm/query params; using a metadata URL that embeds a token; a regional/cloud IdP whose metadata path is unusually deep.","solutions":["Use the shortest valid discovery document URL (often the base issuer + /.well-known/openid-configuration).","If only the authority is needed, leave metadata unset and rely on SsoAuthority discovery.","Validate length in config-loading code before assigning."],"exampleFix":"// before\nauthManager.SsoMetadataAddress = new Uri(metadataUrl);\n\n// after\nif (Uri.IsWellFormedUriString(metadataUrl, UriKind.Absolute) && metadataUrl.Length <= 255)\n    authManager.SsoMetadataAddress = new Uri(metadataUrl);\nelse\n    throw new ConfigurationException(\"SsoMetadataAddress must be an absolute http(s) URL <= 255 chars.\");","handlingStrategy":"validation","validationCode":"static bool ValidSsoMetadata(string url) =>\n    Uri.IsWellFormedUriString(url, UriKind.Absolute)\n    && url.Length <= 255;\n\nif (!ValidSsoMetadata(metadataUrl))\n    throw new ConfigurationException(\"SsoMetadataAddress must be an absolute URL <= 255 chars.\");\nauthManager.SsoMetadataAddress = new Uri(metadataUrl);","typeGuard":null,"tryCatchPattern":"try { authManager.SsoMetadataAddress = new Uri(metadataUrl); }\ncatch (ArgumentException ex) when (ex.ParamName == \"SsoMetadataAddress\")\n{ /* report invalid metadata address */ }","preventionTips":["Use the shortest valid discovery-document URL.","Leave metadata unset if the authority alone is sufficient.","Enforce the length in the config loader."],"tags":["sso","config","validation","length-limit"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}