dotnet/wpf · error · ArgumentOutOfRangeException

ArgumentOutOfRangeException(authentication)

Error message

ArgumentOutOfRangeException(authentication)

What it means

SecureEnvironment.Create(applicationManifest, AuthenticationType, UserActivationMode) validates the authentication enum and accepts only AuthenticationType.Windows or AuthenticationType.Passport. Passing WindowsPassport or Internal throws ArgumentOutOfRangeException for 'authentication' before any activation work begins.

Solutions

1. Pass AuthenticationType.Windows (or Passport) explicitly to SecureEnvironment.Create
2. Never propagate ContentUser.AuthenticationType into this overload — use only Windows/Passport there too
3. If the value comes from config/persistence, validate and normalize it to Windows/Passport before the call

Example fix

// before
var env = SecureEnvironment.Create(manifest, user.AuthenticationType, UserActivationMode.Permanent);

// after
var auth = user.AuthenticationType == AuthenticationType.Passport
    ? AuthenticationType.Passport
    : AuthenticationType.Windows;
var env = SecureEnvironment.Create(manifest, auth, UserActivationMode.Permanent);

if (authentication is not (AuthenticationType.Windows or AuthenticationType.Passport))
    throw new InvalidOperationException("Activation supports only Windows or Passport authentication");

static bool IsActivatableAuth(AuthenticationType a) =>
    a is AuthenticationType.Windows or AuthenticationType.Passport;

try { var env = SecureEnvironment.Create(manifest, authentication, mode); }
catch (ArgumentOutOfRangeException ex) when (ex.ParamName == "authentication")
{
    logger.LogError(ex, "Auth type {Auth} not allowed for activation", authentication);
}

When it happens

Trigger: Calling the activation overload of SecureEnvironment.Create with AuthenticationType.WindowsPassport or AuthenticationType.Internal, e.g. by forwarding a value read from settings or taken from a ContentUser.

Common situations: Mapping a stored auth-type string back to the enum and choosing the wrong member; copying a user's AuthenticationType (Internal/WindowsPassport) into the activation call.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• ArgumentOutOfRangeException(userActivationMode)
• ArgumentOutOfRangeException(authenticationType)
• ArgumentOutOfRangeException(name)
• ArgumentOutOfRangeException(user)
• autoComplete

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/c7bfc0c208bf6755. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/SecureEnvironment.cs:275

            }
            catch
            {
                clientSession.Dispose();
                throw;
            }
        }

        private static SecureEnvironment CriticalCreate(
            string applicationManifest, 
            AuthenticationType authentication,
            UserActivationMode userActivationMode)
        {
            ArgumentNullException.ThrowIfNull(applicationManifest);

            if ((authentication != AuthenticationType.Windows) && 
                 (authentication != AuthenticationType.Passport))
            {
                throw new ArgumentOutOfRangeException(nameof(authentication));
            }

            if ((userActivationMode != UserActivationMode.Permanent) &&
                 (userActivationMode != UserActivationMode.Temporary))
            {
                throw new ArgumentOutOfRangeException(nameof(userActivationMode));            
            }

            //build user with the given authnetication type and a default name 
            // only authentication type is critical in this case 
            ContentUser user; 
            
            using (ClientSession tempClientSession =
                ClientSession.DefaultUserClientSession(authentication))
            {
                //Activate Machine if neccessary
                if (!tempClientSession.IsMachineActivated())
                {

View on GitHub (pinned to 81131a70a4)