dotnet/wpf · error · ArgumentOutOfRangeException

SR.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed

Error message

SR.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed

What it means

SecureEnvironment.IsUserActivated(ContentUser) only accepts users whose AuthenticationType is Windows or Passport. Passing a ContentUser built with WindowsPassport or Internal throws ArgumentOutOfRangeException with the message SR.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed. The API restricts activation checks to real, externally authenticated identities.

Solutions

Construct the user with AuthenticationType.Windows (most common) before calling IsUserActivated
Use AuthenticationType.Passport only when the user authenticates via Passport/.NET Messenger credentials
Keep the publishing-time Internal/Anyone user separate from the consumer identity used for SecureEnvironment calls

Example fix

// before
var user = new ContentUser(Environment.UserName, AuthenticationType.Internal);
bool activated = SecureEnvironment.IsUserActivated(user);

// after
var user = new ContentUser(Environment.UserName, AuthenticationType.Windows);
bool activated = SecureEnvironment.IsUserActivated(user);

Defensive patterns

Strategy: validation

Validate before calling

if (user is null) throw new ArgumentNullException(nameof(user));
if (user.AuthenticationType is not (AuthenticationType.Windows or AuthenticationType.Passport))
    throw new InvalidOperationException("IsUserActivated requires a Windows or Passport user");

Type guard

static bool IsActivationCheckable(ContentUser u) =>
    u?.AuthenticationType is AuthenticationType.Windows or AuthenticationType.Passport;

Try / catch

try { bool ok = SecureEnvironment.IsUserActivated(user); }
catch (ArgumentOutOfRangeException ex)
{
    // wrong auth type (Internal/WindowsPassport); recreate the user as Windows
    logger.LogWarning(ex, "Non-activatable user passed: {Auth}", user?.AuthenticationType);
}

Prevention

Never reuse Internal ('Anyone') publishing users for SecureEnvironment APIs
Centralize ContentUser construction in one factory that only produces Windows/Passport users
Document that only Windows and Passport identities participate in activation

When it happens

Trigger: Calling SecureEnvironment.IsUserActivated(new ContentUser(name, AuthenticationType.WindowsPassport)) or with AuthenticationType.Internal (e.g. the 'Anyone' pseudo-user used in publishing) instead of a Windows or Passport user.

Common situations: Reusing the same ContentUser list that was created to grant rights (which may include Internal 'Anyone') for an environment/activation check; defaulting the auth type to Internal in helper code.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/5b2779f33c3e5cd9. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/SecureEnvironment.cs:66

            return CriticalCreate(applicationManifest, 
                                            authentication,
                                            userActivationMode);
        }
        
        /// <summary>
        /// This property verifies whether the current machine was prepared for consuming and producing RM protected content. 
        /// If property returns true it could be used as an indication that Init function call will not result in a network transaction.
        /// </summary>
        public static bool IsUserActivated(ContentUser user)
        {

            ArgumentNullException.ThrowIfNull(user);

            // we only let specifically identified users to be used here  
            if ((user.AuthenticationType != AuthenticationType.Windows) && 
                 (user.AuthenticationType != AuthenticationType.Passport))
            {
                throw new ArgumentOutOfRangeException(nameof(user), SR.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed);
            }
            
            using (ClientSession userClientSession = new ClientSession(user))
            {
                // if machine activation is not present we can return false right away             
                return (userClientSession.IsMachineActivated() && userClientSession.IsUserActivated());
            }
        }

        /// <summary>
        /// Removes activation for a given user. User must have Windows or Passport authnetication 
        /// </summary>
        public static void RemoveActivatedUser(ContentUser user)
        {

            ArgumentNullException.ThrowIfNull(user);

            // we only let specifically identifyed users to be used here

View on GitHub (pinned to 81131a70a4)