What causes "ArgumentOutOfRangeException(user)" in dotnet/wpf?

Create the ContentUser with AuthenticationType.Windows before calling Create

dotnet/wpf · error · ArgumentOutOfRangeException

ArgumentOutOfRangeException(user)

Error message

ArgumentOutOfRangeException(user)

What it means

SecureEnvironment.Create(applicationManifest, ContentUser) validates the user before creating the session: only AuthenticationType.Windows or AuthenticationType.Passport is accepted. Any other value (WindowsPassport, Internal) throws a bare ArgumentOutOfRangeException for the 'user' parameter, preventing a SecureEnvironment from being built for that identity.

Solutions

Create the ContentUser with AuthenticationType.Windows before calling Create
Use AuthenticationType.Passport if the user authenticates through Passport
Reserve Internal-type users for UnsignedPublishLicense right granting only, never for SecureEnvironment.Create

Example fix

// before
var user = new ContentUser("Anyone", AuthenticationType.Internal);
var env = SecureEnvironment.Create(manifest, user);

// after
var user = new ContentUser(Environment.UserName, AuthenticationType.Windows);
var env = SecureEnvironment.Create(manifest, user);

Defensive patterns

Strategy: validation

Validate before calling

if (user is null) throw new ArgumentNullException(nameof(user));
if (user.AuthenticationType is not (AuthenticationType.Windows or AuthenticationType.Passport))
    throw new InvalidOperationException("SecureEnvironment.Create requires a Windows or Passport user");
if (!SecureEnvironment.IsUserActivated(user))
    throw new InvalidOperationException("User is not activated; run the activation overload of Create first");

Type guard

static bool CanCreateEnvironment(ContentUser u) =>
    u?.AuthenticationType is AuthenticationType.Windows or AuthenticationType.Passport;

Try / catch

try { var env = SecureEnvironment.Create(manifest, user); }
catch (RightsManagementException ex) when (ex.FailureCode == RightsManagementFailureCode.NeedsGroupIdentityActivation)
{
    // fall back to the activation overload, then retry
    using var activating = SecureEnvironment.Create(manifest, AuthenticationType.Windows, UserActivationMode.Permanent);
}
catch (ArgumentOutOfRangeException ex)
{
    logger.LogError(ex, "Unsupported authentication type for SecureEnvironment");
}

Prevention

Check IsUserActivated before Create and implement an activation fallback path
Use a factory method that constructs only Windows/Passport users for consumption scenarios
Ensure the applicationManifest SID matches the signed application manifest, since environment creation also depends on it

When it happens

Trigger: Calling SecureEnvironment.Create(manifest, user) with a ContentUser built using AuthenticationType.Internal ('Anyone'/'Owner') or AuthenticationType.WindowsPassport.

Common situations: Passing the publishing-side user (Internal/Anyone) into the consuming-side environment creation; persisting a user with its auth type and restoring it incorrectly.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/5d1670637c9089b2. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/SecureEnvironment.cs:242

            
                return _clientSession;
            }
        }

        /// <summary>
        /// This static Method builds a new instance of a secure environment for a given user that is assumed to be already activated. 
        /// client Application can use GetActivatedUsers property to enumerate Activated users.
        /// </summary>
        private static SecureEnvironment CriticalCreate(string applicationManifest, ContentUser user)
        {
            ArgumentNullException.ThrowIfNull(applicationManifest);
            ArgumentNullException.ThrowIfNull(user);

            // we only let specifically identifyed users to be used here  
            if ((user.AuthenticationType != AuthenticationType.Windows) && 
                 (user.AuthenticationType != AuthenticationType.Passport))
            {
                throw new ArgumentOutOfRangeException(nameof(user));
            }

            if (!IsUserActivated(user))
            {
                throw new RightsManagementException(RightsManagementFailureCode.NeedsGroupIdentityActivation);
            }
            
            ClientSession clientSession = new ClientSession(user);

            try
            {
                clientSession.BuildSecureEnvironment(applicationManifest);

                return new SecureEnvironment(applicationManifest, user, clientSession);
            }
            catch
            {
                clientSession.Dispose();

View on GitHub (pinned to 81131a70a4)