{"record":{"id":"e29496cf88fd0062","repo":"TechnitiumSoftware/DnsServer","slug":"the-sso-scope-name-length-cannot-be-more-than-255","errorCode":null,"errorMessage":"The SSO Scope name length cannot be more than 255 chars.","messagePattern":"The SSO Scope name length cannot be more than 255 chars\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"warning","filePath":"DnsServerCore/Auth/AuthManager.cs","lineNumber":1422,"sourceCode":"            get { return _ssoScopes; }\n            set\n            {\n                if ((value is null) || (value.Count == 0))\n                {\n                    value = new HashSet<string>() { \"openid\", \"profile\", \"email\" };\n                }\n                else if (value.Count > 255)\n                {\n                    throw new ArgumentException(\"The SSO Scopes cannot have more than 255 entries.\", nameof(SsoScopes));\n                }\n                else if (!value.Contains(\"openid\") || !value.Contains(\"profile\"))\n                {\n                    HashSet<string> ssoScopes = new HashSet<string>() { \"openid\", \"profile\" };\n\n                    foreach (string scope in value)\n                    {\n                        if (scope.Length > 255)\n                            throw new ArgumentException(\"The SSO Scope name length cannot be more than 255 chars.\", nameof(SsoScopes));\n\n                        ssoScopes.Add(scope);\n                    }\n\n                    value = ssoScopes;\n                }\n\n                _ssoScopes = value;\n            }\n        }\n\n        public bool SsoAllowSignup\n        {\n            get { return _ssoAllowSignup; }\n            set { _ssoAllowSignup = value; }\n        }\n\n        public bool SsoAllowSignupOnlyForMappedUsers","sourceCodeStart":1404,"sourceCodeEnd":1440,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/AuthManager.cs#L1404-L1440","documentation":"Thrown by the SsoScopes setter, inside the loop that augments the set with openid/profile, when any individual scope string is longer than 255 characters. It is an ArgumentException (parameter SsoScopes) guarding both the per-entry storage width and OIDC validity. It only runs when the set does not already contain openid/profile (i.e. it is being normalized).","triggerScenarios":"Assigning SsoScopes a set whose normalization branch runs (set lacks openid or profile) AND at least one scope.Length > 255.","commonSituations":"A scope field accidentally populated with a URL or a long claim string instead of a short scope name; copy-paste of a full claim URI into the scopes list.","solutions":["Ensure each entry is a short OIDC scope name (e.g. openid, profile, email, custom-app-scope).","Remove any entry that is a URL/full claim path.","Validate per-entry length in config-loading code before assigning."],"exampleFix":"// before\nauthManager.SsoScopes = scopes;\n\n// after\nif (scopes.Any(s => s.Length > 255))\n    throw new ConfigurationException(\"Each SSO scope must be <= 255 chars.\");\nauthManager.SsoScopes = scopes;","handlingStrategy":"validation","validationCode":"static bool ValidScopes(IEnumerable<string> scopes) =>\n    scopes.All(s => s.Length <= 255);\n\nif (!ValidScopes(rawScopes))\n    throw new ConfigurationException(\"Each SSO scope must be <= 255 chars.\");\nauthManager.SsoScopes = new HashSet<string>(rawScopes);","typeGuard":null,"tryCatchPattern":"try { authManager.SsoScopes = scopes; }\ncatch (ArgumentException ex) when (ex.ParamName == \"SsoScopes\" && ex.Message.Contains(\"Scope name length\"))\n{ /* report over-long scope */ }","preventionTips":["Use short scope names, not claim URLs.","Validate per-entry length in the config loader.","Sanitize imported scope lists."],"tags":["sso","config","validation","length-limit","oidc-scopes"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}