{"record":{"id":"5b2779f33c3e5cd9","repo":"dotnet/wpf","slug":"sr-onlypassportorwindowsauthenticatedusersareallowed-5b2779","errorCode":null,"errorMessage":"SR.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed","messagePattern":"SR\\.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed","errorType":"validation","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/SecureEnvironment.cs","lineNumber":66,"sourceCode":"            return CriticalCreate(applicationManifest, \n                                            authentication,\n                                            userActivationMode);\n        }\n        \n        /// <summary>\n        /// This property verifies whether the current machine was prepared for consuming and producing RM protected content. \n        /// If property returns true it could be used as an indication that Init function call will not result in a network transaction.\n        /// </summary>\n        public static bool IsUserActivated(ContentUser user)\n        {\n\n            ArgumentNullException.ThrowIfNull(user);\n\n            // we only let specifically identified users to be used here  \n            if ((user.AuthenticationType != AuthenticationType.Windows) && \n                 (user.AuthenticationType != AuthenticationType.Passport))\n            {\n                throw new ArgumentOutOfRangeException(nameof(user), SR.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed);\n            }\n            \n            using (ClientSession userClientSession = new ClientSession(user))\n            {\n                // if machine activation is not present we can return false right away             \n                return (userClientSession.IsMachineActivated() && userClientSession.IsUserActivated());\n            }\n        }\n\n        /// <summary>\n        /// Removes activation for a given user. User must have Windows or Passport authnetication \n        /// </summary>\n        public static void RemoveActivatedUser(ContentUser user)\n        {\n\n            ArgumentNullException.ThrowIfNull(user);\n\n            // we only let specifically identifyed users to be used here  ","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/SecureEnvironment.cs#L48-L84","documentation":"SecureEnvironment.IsUserActivated(ContentUser) only accepts users whose AuthenticationType is Windows or Passport. Passing a ContentUser built with WindowsPassport or Internal throws ArgumentOutOfRangeException with the message SR.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed. The API restricts activation checks to real, externally authenticated identities.","triggerScenarios":"Calling SecureEnvironment.IsUserActivated(new ContentUser(name, AuthenticationType.WindowsPassport)) or with AuthenticationType.Internal (e.g. the 'Anyone' pseudo-user used in publishing) instead of a Windows or Passport user.","commonSituations":"Reusing the same ContentUser list that was created to grant rights (which may include Internal 'Anyone') for an environment/activation check; defaulting the auth type to Internal in helper code.","solutions":["Construct the user with AuthenticationType.Windows (most common) before calling IsUserActivated","Use AuthenticationType.Passport only when the user authenticates via Passport/.NET Messenger credentials","Keep the publishing-time Internal/Anyone user separate from the consumer identity used for SecureEnvironment calls"],"exampleFix":"// before\nvar user = new ContentUser(Environment.UserName, AuthenticationType.Internal);\nbool activated = SecureEnvironment.IsUserActivated(user);\n\n// after\nvar user = new ContentUser(Environment.UserName, AuthenticationType.Windows);\nbool activated = SecureEnvironment.IsUserActivated(user);","handlingStrategy":"validation","validationCode":"if (user is null) throw new ArgumentNullException(nameof(user));\nif (user.AuthenticationType is not (AuthenticationType.Windows or AuthenticationType.Passport))\n    throw new InvalidOperationException(\"IsUserActivated requires a Windows or Passport user\");","typeGuard":"static bool IsActivationCheckable(ContentUser u) =>\n    u?.AuthenticationType is AuthenticationType.Windows or AuthenticationType.Passport;","tryCatchPattern":"try { bool ok = SecureEnvironment.IsUserActivated(user); }\ncatch (ArgumentOutOfRangeException ex)\n{\n    // wrong auth type (Internal/WindowsPassport); recreate the user as Windows\n    logger.LogWarning(ex, \"Non-activatable user passed: {Auth}\", user?.AuthenticationType);\n}","preventionTips":["Never reuse Internal ('Anyone') publishing users for SecureEnvironment APIs","Centralize ContentUser construction in one factory that only produces Windows/Passport users","Document that only Windows and Passport identities participate in activation"],"tags":["rights-management","argument-validation","authentication","wpf"],"backgroundTag":"invalid-enum-value","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}