dotnet/wpf · error · ArgumentException

SR.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed

Error message

SR.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed

What it means

SaveUseLicense validates that the ContentUser's AuthenticationType is Windows or Passport before persisting the use license. Any other authentication type is rejected with ArgumentException naming the 'user' parameter. Only these two authentication schemes are supported by the compound-file RM implementation.

Solutions

Ensure the ContentUser is built with AuthenticationType.Windows or AuthenticationType.Passport
Derive users from CryptoProvider/SecureEnvironment APIs rather than constructing them ad hoc
Validate user.AuthenticationType before calling SaveUseLicense
Normalize the user name prefix string so it maps to Windows or Passport authentication

Example fix

// before
var user = new ContentUser("someone@example.com", AuthenticationType.WindowsPassportName); // unsupported
// after
var user = new ContentUser("windows:DOMAIN\\alias", AuthenticationType.Windows);

Defensive patterns

Strategy: validation

Validate before calling

if (user.AuthenticationType != AuthenticationType.Windows && user.AuthenticationType != AuthenticationType.Passport) throw new ArgumentException("User must be Windows or Passport authenticated", nameof(user));

Try / catch

try { transform.SaveUseLicense(user, license); } catch (ArgumentException ex) when (ex.ParamName == "user") { /* log unsupported auth type */ }

Prevention

Only construct ContentUser with AuthenticationType.Windows or Passport
Prefer users obtained from SecureEnvironment/CryptoProvider APIs
Validate AuthenticationType before any RM save call

When it happens

Trigger: Calling SaveUseLicense with a ContentUser whose AuthenticationType is e.g. WindowsLiveIdGeneric or a custom/unknown value instead of AuthenticationType.Windows or AuthenticationType.Passport.

Common situations: Constructing a ContentUser manually with a wrong or default AuthenticationType; users obtained from a different RM service that uses other authentication schemes; mistyping the authentication prefix string ('windows:' vs something else) when building the user.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/709f1248c6f9a785. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/CompoundFile/RightsManagementEncryptionTransform.cs:326

        /// If <paramref name="user"/> or <paramref name="useLicense"/> is null.
        /// </exception>
        /// <exception cref="FileFormatException">
        /// If the RM information in this file cannot be written by the current version of
        /// this class.
        /// </exception>
        internal void
        SaveUseLicense(
            ContentUser user,
            UseLicense useLicense
            )
        {
            ArgumentNullException.ThrowIfNull(user);
            ArgumentNullException.ThrowIfNull(useLicense);

            if (user.AuthenticationType != AuthenticationType.Windows &&
                user.AuthenticationType != AuthenticationType.Passport)
            {
                throw new ArgumentException(
                    SR.OnlyPassportOrWindowsAuthenticatedUsersAreAllowed,
                    nameof(user)
                    );
            }

            //
            // Delete any existing use license for this user.
            //
            EnumUseLicenseStreams(
                new UseLicenseStreamCallback(this.DeleteUseLicenseForUser),
                user
                );

            //
            // Save the new use license for this user in a new stream.
            //
            SaveUseLicenseForUser(user, useLicense);
        }

View on GitHub (pinned to 81131a70a4)