{"record":{"id":"69dd763b14303ea7","repo":"TechnitiumSoftware/DnsServer","slug":"cannot-add-user-to-group-user-can-be-member-of-ma","errorCode":null,"errorMessage":"Cannot add user to group: user can be member of max 255 groups.","messagePattern":"Cannot add user to group: user can be member of max 255 groups\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Auth/User.cs","lineNumber":340,"sourceCode":"            _totpEnabled = false;\n        }\n\n        public void LoggedInFrom(IPAddress remoteAddress)\n        {\n            if (remoteAddress.IsIPv4MappedToIPv6)\n                remoteAddress = remoteAddress.MapToIPv4();\n\n            _previousSessionLoggedOn = _recentSessionLoggedOn;\n            _previousSessionRemoteAddress = _recentSessionRemoteAddress;\n\n            _recentSessionLoggedOn = DateTime.UtcNow;\n            _recentSessionRemoteAddress = remoteAddress;\n        }\n\n        public void AddToGroup(Group group)\n        {\n            if (_memberOfGroups.Count == 255)\n                throw new InvalidOperationException(\"Cannot add user to group: user can be member of max 255 groups.\");\n\n            _memberOfGroups.TryAdd(group.Name.ToLowerInvariant(), group);\n        }\n\n        public bool RemoveFromGroup(Group group)\n        {\n            if (group.Name.Equals(\"everyone\", StringComparison.OrdinalIgnoreCase))\n                throw new InvalidOperationException(\"Access was denied.\");\n\n            return _memberOfGroups.TryRemove(group.Name.ToLowerInvariant(), out _);\n        }\n\n        public void SyncGroups(IReadOnlyDictionary<string, Group> groups)\n        {\n            //remove non-existent groups\n            foreach (KeyValuePair<string, Group> group in _memberOfGroups)\n            {\n                if (!groups.ContainsKey(group.Key))","sourceCodeStart":322,"sourceCodeEnd":358,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/User.cs#L322-L358","documentation":"Thrown by User.AddToGroup(group) when _memberOfGroups already holds 255 entries. The limit exists because the group count is persisted as a single byte in WriteTo (bW.Write(Convert.ToByte(_memberOfGroups.Count))), so a 256th group would overflow serialization. The guard prevents silent truncation/corruption on save.","triggerScenarios":"Calling AddToGroup for the 256th time on a single user, e.g. a bulk group-assignment script or a deep role hierarchy that pushes a user over the limit.","commonSituations":"Auto-provisioning that assigns a user to many fine-grained groups; accumulated stale groups never cleaned up; migration that flattens nested groups into direct memberships.","solutions":["Prune unused or duplicate groups from the user before adding new ones.","Consolidate fine-grained groups into broader roles so membership stays well under 255.","Check _memberOfGroups.Count before calling AddToGroup and surface a clear error to the administrator."],"exampleFix":"// before\nuser.AddToGroup(group);\n\n// after\nconst int MAX = 255;\nif (user.GroupCount >= MAX)\n    throw new InvalidOperationException($\"User already belongs to the maximum of {MAX} groups; remove one first.\");\nuser.AddToGroup(group);","handlingStrategy":"validation","validationCode":"const int MAX_GROUPS = 255;\nif (user.GroupCount >= MAX_GROUPS)\n    return Conflict($\"User is already in the maximum of {MAX_GROUPS} groups.\");\nuser.AddToGroup(group);","typeGuard":"static bool CanAddGroup(User user) => user.GroupCount < 255;","tryCatchPattern":null,"preventionTips":["Track group count and warn before hitting the 255 ceiling.","Consolidate fine-grained groups into broader roles.","Periodically prune stale group memberships."],"tags":["auth","groups","limit","serialization","technitium-dns-server"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}