{"record":{"id":"4f8d1517cd374cb1","repo":"TechnitiumSoftware/DnsServer","slug":"the-sso-authority-url-length-cannot-be-more-than-2","errorCode":null,"errorMessage":"The SSO Authority URL length cannot be more than 255 chars.","messagePattern":"The SSO Authority URL length cannot be more than 255 chars\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"warning","filePath":"DnsServerCore/Auth/AuthManager.cs","lineNumber":1326,"sourceCode":"\n        public ICollection<UserSession> Sessions\n        { get { return _sessions.Values; } }\n\n        public bool SsoEnabled\n        {\n            get { return _ssoEnabled; }\n            set { _ssoEnabled = value; }\n        }\n\n        public Uri SsoAuthority\n        {\n            get { return _ssoAuthority; }\n            set\n            {\n                if (value is not null)\n                {\n                    if (value.OriginalString.Length > 255)\n                        throw new ArgumentException(\"The SSO Authority URL length cannot be more than 255 chars.\", nameof(SsoAuthority));\n\n                    switch (value.Scheme.ToLowerInvariant())\n                    {\n                        case \"http\":\n                        case \"https\":\n                            break;\n\n                        default:\n                            throw new ArgumentException(\"The SSO Authority URL scheme can be 'http' or 'https' only.\", nameof(SsoAuthority));\n                    }\n                }\n\n                _ssoAuthority = value;\n            }\n        }\n\n        public string SsoClientId\n        {","sourceCodeStart":1308,"sourceCodeEnd":1344,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/AuthManager.cs#L1308-L1344","documentation":"Thrown by the SsoAuthority property setter when the supplied Uri's OriginalString exceeds 255 characters. It is an ArgumentException (parameter name SsoAuthority) because the input violates a documented length constraint. The 255 limit matches the underlying storage field width, so longer values would be truncated or rejected by the store.","triggerScenarios":"Assigning AuthManager.SsoAuthority = new Uri(veryLongUrl) where the URL string is longer than 255 chars, while SSO is being configured.","commonSituations":"An IdP discovery/authority URL padded with query parameters, tenant paths, or trailing slashes that push it past 255; copy-pasting a metadata endpoint instead of the bare authority; deploying SSO config via a UI that does not enforce the limit client-side.","solutions":["Use the shortest valid authority URL (typically the IdP base/tenant URL without extra query string).","If the IdP genuinely requires a long URL, point SsoMetadataAddress at the well-known metadata document instead and keep SsoAuthority short.","Validate the URL length in config-loading code before assigning."],"exampleFix":"// before\nauthManager.SsoAuthority = new Uri(authorityUrl);\n\n// after\nif (Uri.IsWellFormedUriString(authorityUrl, UriKind.Absolute) && authorityUrl.Length <= 255)\n    authManager.SsoAuthority = new Uri(authorityUrl);\nelse\n    throw new ConfigurationException(\"SsoAuthority must be an absolute http(s) URL of <= 255 chars.\");","handlingStrategy":"validation","validationCode":"static bool ValidSsoAuthority(string url) =>\n    Uri.IsWellFormedUriString(url, UriKind.Absolute)\n    && url.Length <= 255;\n\nif (!ValidSsoAuthority(authorityUrl))\n    throw new ConfigurationException(\"SsoAuthority must be an absolute URL <= 255 chars.\");\nauthManager.SsoAuthority = new Uri(authorityUrl);","typeGuard":null,"tryCatchPattern":"try { authManager.SsoAuthority = new Uri(authorityUrl); }\ncatch (ArgumentException ex) when (ex.ParamName == \"SsoAuthority\")\n{ /* report invalid SSO authority config */ }","preventionTips":["Enforce the 255-char limit in the config UI/loader before assignment.","Prefer the bare IdP authority URL over long URLs with query strings.","Validate SSO config at startup and fail fast with a clear message."],"tags":["sso","config","validation","length-limit"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}