{"record":{"id":"8b7e170e79b4a1c2","repo":"TechnitiumSoftware/DnsServer","slug":"the-sso-client-secret-length-cannot-be-more-than-2","errorCode":null,"errorMessage":"The SSO Client Secret length cannot be more than 255 chars.","messagePattern":"The SSO Client Secret length cannot be more than 255 chars\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"warning","filePath":"DnsServerCore/Auth/AuthManager.cs","lineNumber":1370,"sourceCode":"                    else if (value.Length > 255)\n                        throw new ArgumentException(\"The SSO Client ID length cannot be more than 255 chars.\", nameof(SsoClientId));\n                }\n\n                _ssoClientId = value;\n            }\n        }\n\n        public string SsoClientSecret\n        {\n            get { return _ssoClientSecret; }\n            set\n            {\n                if (value is not null)\n                {\n                    if (value.Length == 0)\n                        value = null;\n                    else if (value.Length > 255)\n                        throw new ArgumentException(\"The SSO Client Secret length cannot be more than 255 chars.\", nameof(SsoClientSecret));\n                }\n\n                _ssoClientSecret = value;\n            }\n        }\n\n        public Uri SsoMetadataAddress\n        {\n            get { return _ssoMetadataAddress; }\n            set\n            {\n                if (value is not null)\n                {\n                    if (value.OriginalString.Length > 255)\n                        throw new ArgumentException(\"The SSO Metadata Address URL length cannot be more than 255 chars.\", nameof(SsoMetadataAddress));\n\n                    switch (value.Scheme.ToLowerInvariant())\n                    {","sourceCodeStart":1352,"sourceCodeEnd":1388,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/AuthManager.cs#L1352-L1388","documentation":"Thrown by the SsoClientSecret setter when a non-empty secret longer than 255 characters is supplied. Empty strings are normalized to null, so only an over-long non-empty secret triggers it. It is an ArgumentException enforcing the configured storage width for the secret field.","triggerScenarios":"Assigning AuthManager.SsoClientSecret = secret where secret is longer than 255 chars (and not empty).","commonSituations":"Pasting a full JWKS/certificate or a concatenated secret bundle instead of the registered client secret; an IdP that issues very long shared secrets; trailing newline copied from a secrets manager.","solutions":["Confirm you are using the exact OIDC client secret registered at the IdP and trim whitespace/newlines.","If the secret is genuinely >255 chars, rotate it for a shorter one or check whether a token/cert was pasted by mistake.","Validate length in config-loading code."],"exampleFix":"// before\nauthManager.SsoClientSecret = secret;\n\n// after\nauthManager.SsoClientSecret = string.IsNullOrEmpty(secret) || secret.Length > 255\n    ? throw new ConfigurationException(\"SsoClientSecret must be 1..255 chars.\")\n    : secret.Trim();","handlingStrategy":"validation","validationCode":"static bool ValidSsoClientSecret(string s) =>\n    string.IsNullOrEmpty(s) || s.Length <= 255;\n\nvar secret = clientSecret?.Trim('\\n', '\\r', ' ');\nif (!ValidSsoClientSecret(secret))\n    throw new ConfigurationException(\"SsoClientSecret must be 1..255 chars.\");\nauthManager.SsoClientSecret = secret;","typeGuard":null,"tryCatchPattern":"try { authManager.SsoClientSecret = secret; }\ncatch (ArgumentException ex) when (ex.ParamName == \"SsoClientSecret\")\n{ /* report invalid secret length */ }","preventionTips":["Trim trailing newlines that secrets managers often append.","Confirm you pasted the registered client secret, not a cert/token.","Validate length at config load."],"tags":["sso","config","validation","length-limit","secrets"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}