{"record":{"id":"c7bfc0c208bf6755","repo":"dotnet/wpf","slug":"argumentoutofrangeexception-authentication","errorCode":null,"errorMessage":"ArgumentOutOfRangeException(authentication)","messagePattern":"ArgumentOutOfRangeException\\(authentication\\)","errorType":"validation","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/SecureEnvironment.cs","lineNumber":275,"sourceCode":"            }\n            catch\n            {\n                clientSession.Dispose();\n                throw;\n            }\n        }\n\n        private static SecureEnvironment CriticalCreate(\n            string applicationManifest, \n            AuthenticationType authentication,\n            UserActivationMode userActivationMode)\n        {\n            ArgumentNullException.ThrowIfNull(applicationManifest);\n\n            if ((authentication != AuthenticationType.Windows) && \n                 (authentication != AuthenticationType.Passport))\n            {\n                throw new ArgumentOutOfRangeException(nameof(authentication));\n            }\n\n            if ((userActivationMode != UserActivationMode.Permanent) &&\n                 (userActivationMode != UserActivationMode.Temporary))\n            {\n                throw new ArgumentOutOfRangeException(nameof(userActivationMode));            \n            }\n\n            //build user with the given authnetication type and a default name \n            // only authentication type is critical in this case \n            ContentUser user; \n            \n            using (ClientSession tempClientSession =\n                ClientSession.DefaultUserClientSession(authentication))\n            {\n                //Activate Machine if neccessary\n                if (!tempClientSession.IsMachineActivated())\n                {","sourceCodeStart":257,"sourceCodeEnd":293,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/SecureEnvironment.cs#L257-L293","documentation":"SecureEnvironment.Create(applicationManifest, AuthenticationType, UserActivationMode) validates the authentication enum and accepts only AuthenticationType.Windows or AuthenticationType.Passport. Passing WindowsPassport or Internal throws ArgumentOutOfRangeException for 'authentication' before any activation work begins.","triggerScenarios":"Calling the activation overload of SecureEnvironment.Create with AuthenticationType.WindowsPassport or AuthenticationType.Internal, e.g. by forwarding a value read from settings or taken from a ContentUser.","commonSituations":"Mapping a stored auth-type string back to the enum and choosing the wrong member; copying a user's AuthenticationType (Internal/WindowsPassport) into the activation call.","solutions":["Pass AuthenticationType.Windows (or Passport) explicitly to SecureEnvironment.Create","Never propagate ContentUser.AuthenticationType into this overload — use only Windows/Passport there too","If the value comes from config/persistence, validate and normalize it to Windows/Passport before the call"],"exampleFix":"// before\nvar env = SecureEnvironment.Create(manifest, user.AuthenticationType, UserActivationMode.Permanent);\n\n// after\nvar auth = user.AuthenticationType == AuthenticationType.Passport\n    ? AuthenticationType.Passport\n    : AuthenticationType.Windows;\nvar env = SecureEnvironment.Create(manifest, auth, UserActivationMode.Permanent);","handlingStrategy":"validation","validationCode":"if (authentication is not (AuthenticationType.Windows or AuthenticationType.Passport))\n    throw new InvalidOperationException(\"Activation supports only Windows or Passport authentication\");","typeGuard":"static bool IsActivatableAuth(AuthenticationType a) =>\n    a is AuthenticationType.Windows or AuthenticationType.Passport;","tryCatchPattern":"try { var env = SecureEnvironment.Create(manifest, authentication, mode); }\ncatch (ArgumentOutOfRangeException ex) when (ex.ParamName == \"authentication\")\n{\n    logger.LogError(ex, \"Auth type {Auth} not allowed for activation\", authentication);\n}","preventionTips":["Hard-code or tightly constrain authentication to Windows/Passport in activation code","Never pass ContentUser.AuthenticationType (which may be Internal/WindowsPassport) into this overload"],"tags":["rights-management","argument-validation","enum","wpf"],"backgroundTag":"invalid-enum-value","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}