{"record":{"id":"b8c99dceeca3ac9f","repo":"dotnet/wpf","slug":"sr-userhasnoclientlicensorcert","errorCode":null,"errorMessage":"SR.UserHasNoClientLicensorCert","messagePattern":"SR\\.UserHasNoClientLicensorCert","errorType":"exception","errorClass":"MS.Internal.Security.RightsManagement.RightsManagementException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/Security/RightsManagement/ClientSession.cs","lineNumber":522,"sourceCode":"        {\n            CheckDisposed();\n\n            return GetLicenseOnSession(_hSession, enumerateLicenseFlags, index);\n        }\n\n        internal PublishLicense SignIssuanceLicense(IssuanceLicense issuanceLicense, out UseLicense authorUseLicense)\n        {\n            CheckDisposed();\n\n            Invariant.Assert(issuanceLicense != null);\n            Invariant.Assert(!_envHandle.IsInvalid);\n\n            using (CallbackHandler signIssuanceLicenseCallbackHandler = new CallbackHandler())\n            {\n                string clientLicensorCertificate = GetClientLicensorCert();\n\n                if (clientLicensorCertificate == null)\n                    throw new RightsManagementException(SR.UserHasNoClientLicensorCert);\n\n                // Trim all the leading and trailing white space characters\n                // of the clientLicensorCertificate.\n                clientLicensorCertificate = clientLicensorCertificate.Trim();\n\n                // Make sure the clientLicensorCertificate is valid. By trimming white spaces\n                // above, if the certificate string is empty or contains only white spaces, it\n                // is empty now.\n                if (clientLicensorCertificate.Length == 0)\n                    throw new RightsManagementException(SR.UserHasNoClientLicensorCert);\n\n                // Offline publishing supported no Online publishing support \n                int hr = SafeNativeMethods.DRMGetSignedIssuanceLicense(\n                    _envHandle,\n                    issuanceLicense.Handle,\n                    (uint)(SignIssuanceLicenseFlags.Offline |\n                                SignIssuanceLicenseFlags.AutoGenerateKey |\n                                SignIssuanceLicenseFlags.OwnerLicenseNoPersist),","sourceCodeStart":504,"sourceCodeEnd":540,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/Security/RightsManagement/ClientSession.cs#L504-L540","documentation":"SignIssuanceLicense publishes a signed issuance license, which requires a client licensor certificate (CLC) for the current user. The wrapper GetClientLicensorCert() returned null, meaning the AD/RMS machine could not obtain a CLC for the user, so the library throws RightsManagementException with SR.UserHasNoClientLicensorCert. Offline publishing is impossible without this certificate.","triggerScenarios":"Calling ClientSession.SignIssuanceLicense (via UnsignedPublishLicense.Publish / PublishLicense flow) when DRMGetClientLicensorCertificate (native call inside GetClientLicensorCert) returns no certificate for the active user/session — e.g. the user has never been issued a CLC by the RMS server.","commonSituations":"RMS server not reachable or refusing to issue a client licensor certificate; user account not provisioned/licensed in the AD RMS deployment; running in an environment without Active Directory Rights Management Services; locked-down machine where the DRM indiewizard/secure pipeline can't store the certificate.","solutions":["Verify the machine can reach the AD RMS server and that the user is provisioned (open a protected document once or run the RMS client diagnostics to force CLC issuance).","Ensure ActiveDirectoryRightsManagementService client is installed and the machine is joined/registered with the RMS cluster.","If offline publishing is not required, use online publishing flow or acquire the CLC explicitly before calling SignIssuanceLicense.","Catch RightsManagementException and surface a user-facing message explaining the user lacks publishing rights."],"exampleFix":"// before: blindly publish offline\nvar publishLicense = unsignedLicense.Publish(session);\n\n// after: ensure a client licensor cert exists first\nif (secureEnvironment.HasClientLicensorCert == false)\n    throw new InvalidOperationException(\"No client licensor certificate for this user; configure AD RMS provisioning.\");\nvar publishLicense = unsignedLicense.Publish(session);","handlingStrategy":"validation","validationCode":"bool canPublish = secureEnvironment != null && secureEnvironment.HasClientLicensorCert;\nif (!canPublish) throw new InvalidOperationException(\"User has no client licensor certificate; cannot publish offline.\");","typeGuard":null,"tryCatchPattern":"catch (RightsManagementException ex) when (ex.Message.Contains(\"UserHasNoClientLicensorCert\")) { /* prompt user to obtain publishing rights */ }","preventionTips":["Provision users on the AD RMS server before shipping publishing features.","Run RMS client diagnostics in your installer to force CLC issuance.","Feature-detect publishing capability at app start, not at publish time."],"tags":["rights-management","drm","certificate","publishing"],"backgroundTag":"missing-credentials","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}