dotnet/wpf · error · RightsManagementException

RightNotGranted

RightNotGranted

Error message

RightsManagementFailureCode.RightNotGranted

What it means

CryptoProvider.Decrypt throws RightsManagementException with failure code RightNotGranted when CanDecrypt is false — the bound license does not grant the DECRYPT (read) right to the current user. The rights-management runtime refuses to expose plaintext content to principals lacking that right.

Solutions

1. Issue a PublishLicense that grants the required right (VIEW) to the current user, then acquire a UseLicense and rebuild the CryptoProvider
2. Verify the current user/machine is enrolled with the AD RMS/CRM rights service and matches a grantee
3. Check provider.CanDecrypt before calling Decrypt and handle the no-rights path in the UI
4. Re-acquire the license if it expired; ensure the environment (user, certificates) is the one the license was issued for

Example fix

// before
byte[] clear = provider.Decrypt(cryptoText);
// after
if (!provider.CanDecrypt)
{
    // prompt user / request rights from the license issuer
    throw new SecurityException("No decrypt right for current user.");
}
byte[] clear = provider.Decrypt(cryptoText);

if (!provider.CanDecrypt)
    throw new SecurityException("Current user lacks the decrypt (VIEW) right.");

bool CanDecryptSafely(CryptoProvider p) => p is { IsDisposed: false, CanDecrypt: true };

try { clear = provider.Decrypt(cryptoText); }
catch (RightsManagementException rmEx) when (rmEx.FailureCode == RightsManagementFailureCode.RightNotGranted)
{ /* show access-denied UI / request rights */ }

When it happens

Trigger: Calling Decrypt with a CryptoProvider bound to a UseLicense that excludes the VIEW/DECRYPT grant; using another user's credentials; license expired or revoked so rights were not granted at bind time.

Common situations: Sharing a protected document with a user who was not added to the PublishLicense grant list; consuming a license bound to a different account/environment; machine certificate/user certificate mismatch with the licensing server.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• EncryptionNotPermitted
• InvalidLicense
• InvalidLicense
• ArgumentOutOfRangeException(right)
• InvalidLicense

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/63e322f201e6a8c1. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/CryptoProvider.cs:117

            return outputBuffer;
        }

        /// <summary>    
        /// This function decrypts cipher text content.
        /// The length, in bytes, of the buffer holding content to be encrypted should be a multiple of the 
        /// block cipher block size. 
        /// </summary>    
        public byte[] Decrypt(byte[] cryptoText)
        {
            CheckDisposed();

            ArgumentNullException.ThrowIfNull(cryptoText);

            // validation of the proper size of the cryptoText is done by the unmanaged libraries 

            if (!CanDecrypt)
            {
                throw new RightsManagementException(RightsManagementFailureCode.RightNotGranted);
            }
            
            // first get the size
            uint outputBufferSize=0;
            byte[] outputBuffer = null;
            int hr;

#if DEBUG
            hr= SafeNativeMethods.DRMDecrypt(
                            DecryptorHandle,
                            0, 
                            (uint)cryptoText.Length, 
                            cryptoText,
                            ref outputBufferSize,
                            null);
            Errors.ThrowOnErrorCode(hr);

            // We do not expect Decryption changing the size of the buffer; otherwise it will break 

View on GitHub (pinned to 81131a70a4)