{"record":{"id":"b741e86c82a4c50f","repo":"TechnitiumSoftware/DnsServer","slug":"the-sso-group-map-cannot-have-more-than-255-entrie","errorCode":null,"errorMessage":"The SSO Group Map cannot have more than 255 entries.","messagePattern":"The SSO Group Map cannot have more than 255 entries\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"warning","filePath":"DnsServerCore/Auth/AuthManager.cs","lineNumber":1456,"sourceCode":"        }\n\n        public bool SsoAllowSignupOnlyForMappedUsers\n        {\n            get { return _ssoAllowSignupOnlyForMappedUsers; }\n            set { _ssoAllowSignupOnlyForMappedUsers = value; }\n        }\n\n        public IReadOnlyDictionary<string, string> SsoGroupMap\n        {\n            get { return _ssoGroupMap; }\n            set\n            {\n                if (value is not null)\n                {\n                    if (value.Count == 0)\n                        value = null;\n                    else if (value.Count > 255)\n                        throw new ArgumentException(\"The SSO Group Map cannot have more than 255 entries.\", nameof(SsoGroupMap));\n                }\n\n                _ssoGroupMap = value;\n            }\n        }\n\n        public bool SsoManagedGroups\n        { get { return _ssoGroupMap is not null; } }\n\n        #endregion\n    }\n}\n","sourceCodeStart":1438,"sourceCodeEnd":1469,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/AuthManager.cs#L1438-L1469","documentation":"Thrown by the SsoGroupMap setter when the supplied dictionary has more than 255 entries. Empty dictionaries are normalized to null, so only a non-empty map exceeding the cap triggers it. It is an ArgumentException enforcing the configured storage width for the IdP-to-local group mapping.","triggerScenarios":"Assigning AuthManager.SsoGroupMap = map where map is a non-empty dictionary with Count > 255.","commonSituations":"Auto-generating a group map from every IdP group; importing a large directory's group list; a config builder that maps each claim value to a local group without deduping.","solutions":["Map only the IdP groups you actually need to local groups (usually a small handful).","Dedupe and consolidate equivalent groups before assigning.","Validate count in config-loading code before assigning."],"exampleFix":"// before\nauthManager.SsoGroupMap = groupMap;\n\n// after\nvar map = groupMap.Where(kv => !string.IsNullOrWhiteSpace(kv.Key)).Take(255).ToDictionary(kv => kv.Key, kv => kv.Value);\nauthManager.SsoGroupMap = map.Count == 0 ? null : map;","handlingStrategy":"validation","validationCode":"var map = (rawMap ?? new Dictionary<string,string>())\n    .Where(kv => !string.IsNullOrWhiteSpace(kv.Key))\n    .GroupBy(kv => kv.Key, StringComparer.OrdinalIgnoreCase)\n    .ToDictionary(g => g.Key, g => g.First().Value);\nif (map.Count > 255)\n    throw new ConfigurationException(\"SsoGroupMap must contain <= 255 entries.\");\nauthManager.SsoGroupMap = map.Count == 0 ? null : map;","typeGuard":null,"tryCatchPattern":"try { authManager.SsoGroupMap = groupMap; }\ncatch (ArgumentException ex) when (ex.ParamName == \"SsoGroupMap\")\n{ /* report too many entries */ }","preventionTips":["Map only the IdP groups you actually use.","Dedupe keys case-insensitively before assigning.","Validate count in the config loader."],"tags":["sso","config","validation","length-limit","group-mapping"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}