{"record":{"id":"c3840331470c69d3","repo":"TechnitiumSoftware/DnsServer","slug":"the-sso-metadata-address-url-scheme-can-be-http","errorCode":null,"errorMessage":"The SSO Metadata Address URL scheme can be 'http' or 'https' only.","messagePattern":"The SSO Metadata Address URL scheme can be 'http' or 'https' only\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"warning","filePath":"DnsServerCore/Auth/AuthManager.cs","lineNumber":1394,"sourceCode":"\n        public Uri SsoMetadataAddress\n        {\n            get { return _ssoMetadataAddress; }\n            set\n            {\n                if (value is not null)\n                {\n                    if (value.OriginalString.Length > 255)\n                        throw new ArgumentException(\"The SSO Metadata Address URL length cannot be more than 255 chars.\", nameof(SsoMetadataAddress));\n\n                    switch (value.Scheme.ToLowerInvariant())\n                    {\n                        case \"http\":\n                        case \"https\":\n                            break;\n\n                        default:\n                            throw new ArgumentException(\"The SSO Metadata Address URL scheme can be 'http' or 'https' only.\", nameof(SsoMetadataAddress));\n                    }\n                }\n\n                _ssoMetadataAddress = value;\n            }\n        }\n\n        public IReadOnlySet<string> SsoScopes\n        {\n            get { return _ssoScopes; }\n            set\n            {\n                if ((value is null) || (value.Count == 0))\n                {\n                    value = new HashSet<string>() { \"openid\", \"profile\", \"email\" };\n                }\n                else if (value.Count > 255)\n                {","sourceCodeStart":1376,"sourceCodeEnd":1412,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/AuthManager.cs#L1376-L1412","documentation":"Thrown by the SsoMetadataAddress setter when the Uri's scheme is neither http nor https (compared lowercased). It is an ArgumentException because the value is a valid Uri but the scheme is not allowed for fetching OIDC metadata. Mirrors the same scheme guard used for SsoAuthority.","triggerScenarios":"Assigning SsoMetadataAddress a Uri with a non-web scheme (ftp, file, ldap, etc.) or a malformed/relative value that parsed to an unexpected scheme.","commonSituations":"Copy-paste from a config that used a non-web protocol; a file:// path used during local testing; a relative path that Uri did not interpret as https.","solutions":["Ensure the metadata URL begins with http:// or https:// (https in production).","Re-copy the discovery URL from the IdP admin console and fix the scheme.","Validate the scheme in config-loading code before assigning."],"exampleFix":"// before\nauthManager.SsoMetadataAddress = new Uri(metadataUrl);\n\n// after\nvar uri = new Uri(metadataUrl);\nif (uri.Scheme.Equals(\"http\", StringComparison.OrdinalIgnoreCase) || uri.Scheme.Equals(\"https\", StringComparison.OrdinalIgnoreCase))\n    authManager.SsoMetadataAddress = uri;\nelse\n    throw new ConfigurationException(\"SsoMetadataAddress scheme must be http or https.\");","handlingStrategy":"validation","validationCode":"static bool ValidMetadataScheme(string url)\n{\n    if (!Uri.IsWellFormedUriString(url, UriKind.Absolute)) return false;\n    var s = new Uri(url).Scheme.ToLowerInvariant();\n    return s == \"http\" || s == \"https\";\n}\n\nif (!ValidMetadataScheme(metadataUrl))\n    throw new ConfigurationException(\"SsoMetadataAddress scheme must be http or https.\");\nauthManager.SsoMetadataAddress = new Uri(metadataUrl);","typeGuard":null,"tryCatchPattern":"try { authManager.SsoMetadataAddress = new Uri(metadataUrl); }\ncatch (ArgumentException ex) when (ex.ParamName == \"SsoMetadataAddress\")\n{ /* report invalid scheme */ }","preventionTips":["Prefix metadata URLs with https://.","Validate the scheme in config-loading code.","Avoid file:// or other schemes even for local testing."],"tags":["sso","config","validation","uri-scheme"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}