{"record":{"id":"9f458ed11e7a29cd","repo":"TechnitiumSoftware/DnsServer","slug":"the-sso-authority-url-scheme-can-be-http-or-htt","errorCode":null,"errorMessage":"The SSO Authority URL scheme can be 'http' or 'https' only.","messagePattern":"The SSO Authority URL scheme can be 'http' or 'https' only\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"warning","filePath":"DnsServerCore/Auth/AuthManager.cs","lineNumber":1335,"sourceCode":"\n        public Uri SsoAuthority\n        {\n            get { return _ssoAuthority; }\n            set\n            {\n                if (value is not null)\n                {\n                    if (value.OriginalString.Length > 255)\n                        throw new ArgumentException(\"The SSO Authority URL length cannot be more than 255 chars.\", nameof(SsoAuthority));\n\n                    switch (value.Scheme.ToLowerInvariant())\n                    {\n                        case \"http\":\n                        case \"https\":\n                            break;\n\n                        default:\n                            throw new ArgumentException(\"The SSO Authority URL scheme can be 'http' or 'https' only.\", nameof(SsoAuthority));\n                    }\n                }\n\n                _ssoAuthority = value;\n            }\n        }\n\n        public string SsoClientId\n        {\n            get { return _ssoClientId; }\n            set\n            {\n                if (value is not null)\n                {\n                    if (value.Length == 0)\n                        value = null;\n                    else if (value.Length > 255)\n                        throw new ArgumentException(\"The SSO Client ID length cannot be more than 255 chars.\", nameof(SsoClientId));","sourceCodeStart":1317,"sourceCodeEnd":1353,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/AuthManager.cs#L1317-L1353","documentation":"Thrown by the SsoAuthority setter when the Uri's scheme is neither http nor https (lowercased before comparison). It is an ArgumentException because the value type is valid Uri but the scheme is not permitted for an OIDC authority. Only standard web schemes are accepted so the OIDC client does not attempt an unsupported transport.","triggerScenarios":"Assigning SsoAuthority a Uri whose Scheme is e.g. ftp, file, ldap, or a custom scheme; or a relative/malformed string that Uri parsed with an unexpected scheme.","commonSituations":"Pasting an ldaps:// or ftp:// endpoint by mistake; using a bare host without https:// so Uri infers a relative/odd scheme; misconfigured reverse-proxy URL copied from a config that used a non-web protocol.","solutions":["Ensure the authority URL starts with http:// or https:// (https recommended for production).","Re-check the copied value against the IdP documentation and fix the scheme.","Validate the scheme in config-loading code before assigning."],"exampleFix":"// before\nauthManager.SsoAuthority = new Uri(authorityUrl);\n\n// after\nvar uri = new Uri(authorityUrl);\nif (uri.Scheme.Equals(\"http\", StringComparison.OrdinalIgnoreCase) || uri.Scheme.Equals(\"https\", StringComparison.OrdinalIgnoreCase))\n    authManager.SsoAuthority = uri;\nelse\n    throw new ConfigurationException(\"SsoAuthority scheme must be http or https.\");","handlingStrategy":"validation","validationCode":"static bool ValidSsoScheme(string url)\n{\n    if (!Uri.IsWellFormedUriString(url, UriKind.Absolute)) return false;\n    var s = new Uri(url).Scheme.ToLowerInvariant();\n    return s == \"http\" || s == \"https\";\n}\n\nif (!ValidSsoScheme(authorityUrl))\n    throw new ConfigurationException(\"SsoAuthority scheme must be http or https.\");\nauthManager.SsoAuthority = new Uri(authorityUrl);","typeGuard":null,"tryCatchPattern":"try { authManager.SsoAuthority = new Uri(authorityUrl); }\ncatch (ArgumentException ex) when (ex.ParamName == \"SsoAuthority\")\n{ /* report invalid scheme */ }","preventionTips":["Always prefix the authority URL with https:// (http only for local testing).","Validate the scheme in config-loading code before assignment.","Beware of copy-paste dropping the scheme prefix."],"tags":["sso","config","validation","uri-scheme"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}