{"record":{"id":"709f1248c6f9a785","repo":"dotnet/wpf","slug":"sr-onlypassportorwindowsauthenticatedusersareallowed","errorCode":null,"errorMessage":"SR.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed","messagePattern":"SR\\.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/CompoundFile/RightsManagementEncryptionTransform.cs","lineNumber":326,"sourceCode":"        /// If <paramref name=\"user\"/> or <paramref name=\"useLicense\"/> is null.\n        /// </exception>\n        /// <exception cref=\"FileFormatException\">\n        /// If the RM information in this file cannot be written by the current version of\n        /// this class.\n        /// </exception>\n        internal void\n        SaveUseLicense(\n            ContentUser user,\n            UseLicense useLicense\n            )\n        {\n            ArgumentNullException.ThrowIfNull(user);\n            ArgumentNullException.ThrowIfNull(useLicense);\n\n            if (user.AuthenticationType != AuthenticationType.Windows &&\n                user.AuthenticationType != AuthenticationType.Passport)\n            {\n                throw new ArgumentException(\n                    SR.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed,\n                    nameof(user)\n                    );\n            }\n\n            //\n            // Delete any existing use license for this user.\n            //\n            EnumUseLicenseStreams(\n                new UseLicenseStreamCallback(this.DeleteUseLicenseForUser),\n                user\n                );\n\n            //\n            // Save the new use license for this user in a new stream.\n            //\n            SaveUseLicenseForUser(user, useLicense);\n        }","sourceCodeStart":308,"sourceCodeEnd":344,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/CompoundFile/RightsManagementEncryptionTransform.cs#L308-L344","documentation":"SaveUseLicense validates that the ContentUser's AuthenticationType is Windows or Passport before persisting the use license. Any other authentication type is rejected with ArgumentException naming the 'user' parameter. Only these two authentication schemes are supported by the compound-file RM implementation.","triggerScenarios":"Calling SaveUseLicense with a ContentUser whose AuthenticationType is e.g. WindowsLiveIdGeneric or a custom/unknown value instead of AuthenticationType.Windows or AuthenticationType.Passport.","commonSituations":"Constructing a ContentUser manually with a wrong or default AuthenticationType; users obtained from a different RM service that uses other authentication schemes; mistyping the authentication prefix string ('windows:' vs something else) when building the user.","solutions":["Ensure the ContentUser is built with AuthenticationType.Windows or AuthenticationType.Passport","Derive users from CryptoProvider/SecureEnvironment APIs rather than constructing them ad hoc","Validate user.AuthenticationType before calling SaveUseLicense","Normalize the user name prefix string so it maps to Windows or Passport authentication"],"exampleFix":"// before\nvar user = new ContentUser(\"someone@example.com\", AuthenticationType.WindowsPassportName); // unsupported\n// after\nvar user = new ContentUser(\"windows:DOMAIN\\\\alias\", AuthenticationType.Windows);","handlingStrategy":"validation","validationCode":"if (user.AuthenticationType != AuthenticationType.Windows && user.AuthenticationType != AuthenticationType.Passport) throw new ArgumentException(\"User must be Windows or Passport authenticated\", nameof(user));","typeGuard":null,"tryCatchPattern":"try { transform.SaveUseLicense(user, license); } catch (ArgumentException ex) when (ex.ParamName == \"user\") { /* log unsupported auth type */ }","preventionTips":["Only construct ContentUser with AuthenticationType.Windows or Passport","Prefer users obtained from SecureEnvironment/CryptoProvider APIs","Validate AuthenticationType before any RM save call"],"tags":["wpf","rights-management","argument-exception","authentication"],"backgroundTag":"invalid-argument-value","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-22T01:17:13.364Z"}