dotnet/wpf · error · InvalidOperationException

SR.RMProviderExceptionNotOwnerOfDocument

Error message

SR.RMProviderExceptionNotOwnerOfDocument

What it means

GenerateUnsignedPublishLicense lets owners republish a document with different permissions. If the document is already protected and the current use license does not grant AllowOwner, it throws RMProviderExceptionNotOwnerOfDocument, preventing non-owners from altering access rights.

Solutions

  1. Load/acquire the owner's use license (with AllowOwner) before generating a new publish license
  2. Have an owner perform the republish, or generate a fresh document/license instead of republishing
  3. Check HasPermission(existing license, AllowOwner) up front and show an appropriate error in the UI

Example fix

// before
var newLicense = provider.GenerateUnsignedPublishLicense(grants);
// after
if (!provider.IsProtected || ownerHasAllowOwner)
    var newLicense = provider.GenerateUnsignedPublishLicense(grants);
else
    throw new UnauthorizedAccessException("Only the owner can republish this document.");
Defensive patterns

Strategy: validation

Validate before calling

var lic = GetUseLicense();
if (provider.IsProtected && (lic == null || !lic.HasPermission(RightsManagementPermissions.AllowOwner)))
    throw new InvalidOperationException("Owner rights required to republish.");

Type guard

bool CanRepublish(IRightsManagementProvider p) => !p.IsProtected || p.HasPermission(p.UseLicense, RightsManagementPermissions.AllowOwner);

Try / catch

try { provider.GenerateUnsignedPublishLicense(grants); }
catch (InvalidOperationException) { /* non-owner: disable republish UI */ }

Prevention

When it happens

Trigger: Calling GenerateUnsignedPublishLicense on an already-protected package while the bound use license lacks RightsManagementPermissions.AllowOwner.

Common situations: Non-owner attempts to re-permission someone else's protected document; app runs under a different user than the document owner; owner license not loaded before republishing.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/0c6a28a4998c896b. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/PresentationUI/MS/Internal/Documents/RightsManagementProvider.cs:646

    /// of licenses.
    /// </summary>
    /// <param name="licenses">
    /// The list of licenses from which to generate a publish license</param>
    /// <param name="validUntil">
    /// The optional date until when the publish license will be valid</param>
    /// <param name="referralUri">
    /// A URI to contact to request additional permissions</param>
    void IRightsManagementProvider.GenerateUnsignedPublishLicense(
        IList<RightsManagementLicense> licenses)
    {
        ArgumentNullException.ThrowIfNull(licenses);

        // If the document is already protected, only owners can republish it
        // with different permissions
        if (IsProtected && !HasPermission(
            _rmUseLicense, RightsManagementPermissions.AllowOwner))
        {
            throw new InvalidOperationException(
                SR.RMProviderExceptionNotOwnerOfDocument);
        }

        Trace.SafeWrite(
            Trace.Rights, "Creating a publish license for the document.");

        //
        // Create the unsigned publish license
        //

        UnsignedPublishLicense unsignedPublishLicense = null;

        unsignedPublishLicense = new UnsignedPublishLicense();

        ICollection<ContentGrant> licenseGrants =
            GetGrantsFromUnsignedLicense(unsignedPublishLicense);

        //

View on GitHub (pinned to 81131a70a4)