{"record":{"id":"5d1670637c9089b2","repo":"dotnet/wpf","slug":"argumentoutofrangeexception-user","errorCode":null,"errorMessage":"ArgumentOutOfRangeException(user)","messagePattern":"ArgumentOutOfRangeException\\(user\\)","errorType":"validation","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/SecureEnvironment.cs","lineNumber":242,"sourceCode":"            \n                return _clientSession;\n            }\n        }\n\n        /// <summary>\n        /// This static Method builds a new instance of a secure environment for a given user that is assumed to be already activated. \n        /// client Application can use GetActivatedUsers property to enumerate Activated users.\n        /// </summary>\n        private static SecureEnvironment CriticalCreate(string applicationManifest, ContentUser user)\n        {\n            ArgumentNullException.ThrowIfNull(applicationManifest);\n            ArgumentNullException.ThrowIfNull(user);\n\n            // we only let specifically identifyed users to be used here  \n            if ((user.AuthenticationType != AuthenticationType.Windows) && \n                 (user.AuthenticationType != AuthenticationType.Passport))\n            {\n                throw new ArgumentOutOfRangeException(nameof(user));\n            }\n\n            if (!IsUserActivated(user))\n            {\n                throw new RightsManagementException(RightsManagementFailureCode.NeedsGroupIdentityActivation);\n            }\n            \n            ClientSession clientSession = new ClientSession(user);\n\n            try\n            {\n                clientSession.BuildSecureEnvironment(applicationManifest);\n\n                return new SecureEnvironment(applicationManifest, user, clientSession);\n            }\n            catch\n            {\n                clientSession.Dispose();","sourceCodeStart":224,"sourceCodeEnd":260,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/SecureEnvironment.cs#L224-L260","documentation":"SecureEnvironment.Create(applicationManifest, ContentUser) validates the user before creating the session: only AuthenticationType.Windows or AuthenticationType.Passport is accepted. Any other value (WindowsPassport, Internal) throws a bare ArgumentOutOfRangeException for the 'user' parameter, preventing a SecureEnvironment from being built for that identity.","triggerScenarios":"Calling SecureEnvironment.Create(manifest, user) with a ContentUser built using AuthenticationType.Internal ('Anyone'/'Owner') or AuthenticationType.WindowsPassport.","commonSituations":"Passing the publishing-side user (Internal/Anyone) into the consuming-side environment creation; persisting a user with its auth type and restoring it incorrectly.","solutions":["Create the ContentUser with AuthenticationType.Windows before calling Create","Use AuthenticationType.Passport if the user authenticates through Passport","Reserve Internal-type users for UnsignedPublishLicense right granting only, never for SecureEnvironment.Create"],"exampleFix":"// before\nvar user = new ContentUser(\"Anyone\", AuthenticationType.Internal);\nvar env = SecureEnvironment.Create(manifest, user);\n\n// after\nvar user = new ContentUser(Environment.UserName, AuthenticationType.Windows);\nvar env = SecureEnvironment.Create(manifest, user);","handlingStrategy":"validation","validationCode":"if (user is null) throw new ArgumentNullException(nameof(user));\nif (user.AuthenticationType is not (AuthenticationType.Windows or AuthenticationType.Passport))\n    throw new InvalidOperationException(\"SecureEnvironment.Create requires a Windows or Passport user\");\nif (!SecureEnvironment.IsUserActivated(user))\n    throw new InvalidOperationException(\"User is not activated; run the activation overload of Create first\");","typeGuard":"static bool CanCreateEnvironment(ContentUser u) =>\n    u?.AuthenticationType is AuthenticationType.Windows or AuthenticationType.Passport;","tryCatchPattern":"try { var env = SecureEnvironment.Create(manifest, user); }\ncatch (RightsManagementException ex) when (ex.FailureCode == RightsManagementFailureCode.NeedsGroupIdentityActivation)\n{\n    // fall back to the activation overload, then retry\n    using var activating = SecureEnvironment.Create(manifest, AuthenticationType.Windows, UserActivationMode.Permanent);\n}\ncatch (ArgumentOutOfRangeException ex)\n{\n    logger.LogError(ex, \"Unsupported authentication type for SecureEnvironment\");\n}","preventionTips":["Check IsUserActivated before Create and implement an activation fallback path","Use a factory method that constructs only Windows/Passport users for consumption scenarios","Ensure the applicationManifest SID matches the signed application manifest, since environment creation also depends on it"],"tags":["rights-management","argument-validation","authentication","wpf"],"backgroundTag":"invalid-enum-value","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}