{"record":{"id":"63e322f201e6a8c1","repo":"dotnet/wpf","slug":"rightnotgranted","errorCode":"RightNotGranted","errorMessage":"RightsManagementFailureCode.RightNotGranted","messagePattern":"RightsManagementFailureCode\\.RightNotGranted","errorType":"error_code","errorClass":"RightsManagementException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/CryptoProvider.cs","lineNumber":117,"sourceCode":"            return outputBuffer;\n        }\n\n        /// <summary>    \n        /// This function decrypts cipher text content.\n        /// The length, in bytes, of the buffer holding content to be encrypted should be a multiple of the \n        /// block cipher block size. \n        /// </summary>    \n        public byte[] Decrypt(byte[] cryptoText)\n        {\n            CheckDisposed();\n\n            ArgumentNullException.ThrowIfNull(cryptoText);\n\n            // validation of the proper size of the cryptoText is done by the unmanaged libraries \n\n            if (!CanDecrypt)\n            {\n                throw new RightsManagementException(RightsManagementFailureCode.RightNotGranted);\n            }\n            \n            // first get the size\n            uint outputBufferSize=0;\n            byte[] outputBuffer = null;\n            int hr;\n\n#if DEBUG\n            hr= SafeNativeMethods.DRMDecrypt(\n                            DecryptorHandle,\n                            0, \n                            (uint)cryptoText.Length, \n                            cryptoText,\n                            ref outputBufferSize,\n                            null);\n            Errors.ThrowOnErrorCode(hr);\n\n            // We do not expect Decryption changing the size of the buffer; otherwise it will break ","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/CryptoProvider.cs#L99-L135","documentation":"CryptoProvider.Decrypt throws RightsManagementException with failure code RightNotGranted when CanDecrypt is false — the bound license does not grant the DECRYPT (read) right to the current user. The rights-management runtime refuses to expose plaintext content to principals lacking that right.","triggerScenarios":"Calling Decrypt with a CryptoProvider bound to a UseLicense that excludes the VIEW/DECRYPT grant; using another user's credentials; license expired or revoked so rights were not granted at bind time.","commonSituations":"Sharing a protected document with a user who was not added to the PublishLicense grant list; consuming a license bound to a different account/environment; machine certificate/user certificate mismatch with the licensing server.","solutions":["Issue a PublishLicense that grants the required right (VIEW) to the current user, then acquire a UseLicense and rebuild the CryptoProvider","Verify the current user/machine is enrolled with the AD RMS/CRM rights service and matches a grantee","Check provider.CanDecrypt before calling Decrypt and handle the no-rights path in the UI","Re-acquire the license if it expired; ensure the environment (user, certificates) is the one the license was issued for"],"exampleFix":"// before\nbyte[] clear = provider.Decrypt(cryptoText);\n// after\nif (!provider.CanDecrypt)\n{\n    // prompt user / request rights from the license issuer\n    throw new SecurityException(\"No decrypt right for current user.\");\n}\nbyte[] clear = provider.Decrypt(cryptoText);","handlingStrategy":"validation","validationCode":"if (!provider.CanDecrypt)\n    throw new SecurityException(\"Current user lacks the decrypt (VIEW) right.\");","typeGuard":"bool CanDecryptSafely(CryptoProvider p) => p is { IsDisposed: false, CanDecrypt: true };","tryCatchPattern":"try { clear = provider.Decrypt(cryptoText); }\ncatch (RightsManagementException rmEx) when (rmEx.FailureCode == RightsManagementFailureCode.RightNotGranted)\n{ /* show access-denied UI / request rights */ }","preventionTips":["Verify grants with BoundGrants / CanDecrypt before decrypting","Ensure the consuming user is listed in the PublishLicense grants","Handle license expiry by re-acquiring UseLicense from the server"],"tags":["drm","rights-management","decryption","license"],"backgroundTag":"permission-denied","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}