dotnet/wpf · error · ArgumentOutOfRangeException

ArgumentOutOfRangeException(authenticationType)

Error message

ArgumentOutOfRangeException(authenticationType)

What it means

The ContentUser constructor in WPF's Rights Management (IRM) API throws ArgumentOutOfRangeException when authenticationType is not one of the four supported AuthenticationType values: Windows, Passport, WindowsPassport, or Internal. The API validates enum input eagerly rather than accepting arbitrary enum casts, since .NET enums can hold any underlying integer.

Solutions

Pass a literal AuthenticationType enum member (Windows, Passport, WindowsPassport, or Internal) instead of a cast integer.
Validate the incoming value with Enum.IsDefined(typeof(AuthenticationType), value) before constructing ContentUser.
Check persisted data/config for stale or out-of-range integer values that no longer map to a defined enum member.

Example fix

// before
var user = new ContentUser(name, (AuthenticationType)storedValue);
// after
if (!Enum.IsDefined(typeof(AuthenticationType), storedValue))
    throw new InvalidOperationException($"Unknown AuthenticationType: {storedValue}");
var user = new ContentUser(name, (AuthenticationType)storedValue);

Defensive patterns

Strategy: validation

Validate before calling

bool IsValidAuthType(AuthenticationType t) =>
    t == AuthenticationType.Windows || t == AuthenticationType.Passport ||
    t == AuthenticationType.WindowsPassport || t == AuthenticationType.Internal;

Type guard

bool IsDefinedAuthenticationType(object v, out AuthenticationType t)
{
    t = default;
    return v is AuthenticationType a && Enum.IsDefined(typeof(AuthenticationType), a) && (t = a) == a;
}

Try / catch

try { var user = new ContentUser(name, authType); }
catch (ArgumentOutOfRangeException ex) when (ex.ParamName == "authenticationType")
{
    log.LogError($"Unsupported AuthenticationType: {authType}");
}

Prevention

Only pass literal AuthenticationType members, never raw ints.
Validate with Enum.IsDefined before constructing.
Never persist enums as unchecked integers without a read-back validation.

When it happens

Trigger: Calling new ContentUser(name, (AuthenticationType)someInt) with an int that is not a defined AuthenticationType member; passing a default(AuthenticationType) value of 0 if it is not a defined member; casting between unrelated enum types.

Common situations: Persisting an AuthenticationType to a database or config as an int and casting it back after the enum definition changed; deserializing user records authored by a different library version; passing null-boxed or invalid enum values from external data.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/6088e5fb703febb4. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/User.cs:34

        ///  This constructor creates a user that will be granted a right. Or used in other related scenarios like
        /// initializing secure environment for the user, or enumerating rights granted to various users.         
        /// </summary>
        public ContentUser(string name, AuthenticationType authenticationType)
        {

            ArgumentNullException.ThrowIfNull(name);

            if (name.Trim().Length == 0)
            {
                throw new ArgumentOutOfRangeException(nameof(name));
            }

            if ((authenticationType != AuthenticationType.Windows) &&
                (authenticationType != AuthenticationType.Passport) &&
                (authenticationType != AuthenticationType.WindowsPassport) &&
                (authenticationType != AuthenticationType.Internal))
            {
                throw new ArgumentOutOfRangeException(nameof(authenticationType));
            }

            // We only support Anyone for the internal mode at the moment
            if (authenticationType == AuthenticationType.Internal)
            {
                if (!CompareToAnyone(name) && !CompareToOwner(name))
                {
                    // we only support Anyone as internal user 
                    throw new ArgumentOutOfRangeException(nameof(name));
                }
            }

            _name = name;
            _authenticationType = authenticationType;
        }

        /// <summary>
        /// Currently only 2 Authentication types supported Windows and Passport

View on GitHub (pinned to 81131a70a4)