dotnet/wpf · error · MS.Internal.Security.RightsManagement.RightsManagementException

LicenseAcquisitionFailed

LicenseAcquisitionFailed

Error message

RightsManagementFailureCode.LicenseAcquisitionFailed

What it means

AcquireUseLicense asks the native DRM layer to acquire a use license, then diffs the license-ID list before and after acquisition. If no new license entry appears (FindNewEntryIndex returns < 0), the library concludes acquisition failed and throws RightsManagementException with failure code LicenseAcquisitionFailed.

Solutions

  1. Verify the user actually has rights granted in the issuance/publishing license (UseLicense content user and rights list).
  2. Check network connectivity to the RMS cluster and confirm server event logs show the license-acquisition request.
  3. Clear the user's DRM license store so stale cached IDs don't mask the newly acquired license, then retry.
  4. Retry acquisition after fixing clock skew (Kerberos/RMS are time sensitive).

Example fix

// before
UseLicense ul = session.AcquireUseLicense(secureEnvironment, contentUser);

// after: check rights first and handle failure
if (!unsignedPublishLicense.Grants.ContainsRightFor(contentUser))
    throw new InvalidOperationException("User has no granted rights; use license acquisition will fail.");
try { UseLicense ul = session.AcquireUseLicense(secureEnvironment, contentUser); }
catch (RightsManagementException ex) when (ex.FailureCode == RightsManagementFailureCode.LicenseAcquisitionFailed) { /* inform user */ }
Defensive patterns

Strategy: try-catch

Validate before calling

if (!unsignedLicense.Grants.Any(g => g.ContentUser.Equals(user)))
    throw new InvalidOperationException("User has no rights in the issuance license; use-license acquisition will fail.");

Try / catch

catch (RightsManagementException ex) when (ex.FailureCode == RightsManagementFailureCode.LicenseAcquisitionFailed) { /* check server reachability and granted rights, then retry */ }

Prevention

When it happens

Trigger: Calling CryptographicSession/ClientSession.AcquireUseLicense (e.g. via EncryptedPackageEnvelope opening, UseLicense acquisition in ProtectedDocument flows) where the server does not return a new EUL entry in the session license list.

Common situations: User is not granted any rights on the issuance license; RMS server unreachable or returned an error that the wrapper silently mapped to 'no new license'; clock skew or expired content making the server decline issuance; license already cached but with a changed ID scheme.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/0504871bdfbcc185. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/Security/RightsManagement/ClientSession.cs:621

                    null,  // requested data is reserved and not used
                    null, // custom data 
                    null, //no url required it will be taken from publish license   
                    IntPtr.Zero);    // context 

                Errors.ThrowOnErrorCode(hr);

                _callbackHandler.WaitForCompletion();         // it will throw a proper exception in a failure case            

                // now we can enumerate the EUL Ids  again and try to find the new one 
                ArrayList newLicenseIds = EnumerateAllValuesOnSession
                                        (licenseStorageSessionHandle, EnumerateLicenseFlags.EulLid);

                int indexOfTheAcquiredLicense = FindNewEntryIndex(oldLicenseIds, newLicenseIds);

                if (indexOfTheAcquiredLicense < 0)
                {
                    // we have failed to find the new license 
                    throw new RightsManagementException(RightsManagementFailureCode.LicenseAcquisitionFailed);
                }

                return new UseLicense(GetLicenseOnSession(
                                                            licenseStorageSessionHandle,
                                                            EnumerateLicenseFlags.Eul,
                                                            indexOfTheAcquiredLicense));
            }
        }

        private static int FindNewEntryIndex(ArrayList oldList, ArrayList newList)
        {
            Invariant.Assert((oldList != null) && (newList != null));

            for (int i = 0; i < newList.Count; i++)
            {
                string newElement = (string)newList[i];
                bool matchFound = false;

View on GitHub (pinned to 81131a70a4)