dotnet/wpf · error · XpsViewerException

SR.RMProviderExceptionNoRightsToDocument

Error message

SR.RMProviderExceptionNoRightsToDocument

What it means

Thrown by RightsManagementManager.SetEncryptedPackage when a newly loaded rights-managed XPS package cannot be opened for viewing. GetUseLicense() returned no usable license or the license lacks the AllowView permission, meaning the current user is not granted view rights by the document's publish license. The viewer refuses to decrypt/display a document the user has no rights to.

Solutions

Verify the current user is listed as a grantee with View rights in the document's publish license
Confirm the Active Directory RM environment/cluster URL is reachable and the user is activated for it
Re-acquire the use license (check license expiry/revocation) or re-publish the document granting the user rights
Decrypt the document for the intended user before opening it in the viewer

Defensive patterns

Strategy: try-catch

Validate before calling

// check rights before opening
if (!rmManager.IsProtected || userHasViewRights(useLicense)) { open(); }

Type guard

bool IsViewable(RightsManagementLicense l) => l != null && l.HasPermission(RightsManagementPermissions.AllowView);

Try / catch

try { rmManager.SetEncryptedPackage(pkg); }
catch (XpsViewerException ex) { /* show 'no rights to view document' UI */ }

Prevention

Confirm the user has View rights before opening protected documents
Keep the RM environment (AD RMS cluster) reachable and the account activated
Watch for expired/revoked licenses and re-acquire them

When it happens

Trigger: Calling SetEncryptedPackage with an encrypted package whose use license is missing, expired, or does not grant AllowView to the current user (e.g. RM environment/user account differs from the one the document was published to).

Common situations: Opening an RM-protected XPS on a machine without Active Directory Rights Management Services access; user account not in the grant list; expired or revoked license; wrong RM cluster/URL configuration.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/fa64d8c5f26ecf66. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/PresentationUI/MS/Internal/Documents/RightsManagementManager.cs:223

                    RightsManagementOperation.Decrypt,
                    exception);

                // On an exception here we can't continue; rethrow it in an
                // XPSViewer exception
                throw new XpsViewerException(
                    SR.XpsViewerRightsManagementException,
                    exception);
            }

            if (_rmProvider.IsProtected)
            {
                // Get a use license for the new package
                RightsManagementLicense license = GetUseLicense();

                if (license == null ||
                    !license.HasPermission(RightsManagementPermissions.AllowView))
                {
                    throw new XpsViewerException(
                        SR.RMProviderExceptionNoRightsToDocument);
                }
            }

            if (publishLicenseChanged)
            {
                // Fire the event to indicate a new publish license
                OnPublishLicenseChange();
            }

            // Evaluate the status of the new package (to fire events)
            Evaluate();
        }

        /// <summary>
        /// Displays the Credential Management UI.
        /// </summary>
        internal void ShowCredentialManagementUI()

View on GitHub (pinned to 81131a70a4)