dotnet/wpf · error · MS.Internal.Security.RightsManagement.RightsManagementException

SR.UserHasNoClientLicensorCert

Error message

SR.UserHasNoClientLicensorCert

What it means

SignIssuanceLicense publishes a signed issuance license, which requires a client licensor certificate (CLC) for the current user. The wrapper GetClientLicensorCert() returned null, meaning the AD/RMS machine could not obtain a CLC for the user, so the library throws RightsManagementException with SR.UserHasNoClientLicensorCert. Offline publishing is impossible without this certificate.

Solutions

1. Verify the machine can reach the AD RMS server and that the user is provisioned (open a protected document once or run the RMS client diagnostics to force CLC issuance).
2. Ensure ActiveDirectoryRightsManagementService client is installed and the machine is joined/registered with the RMS cluster.
3. If offline publishing is not required, use online publishing flow or acquire the CLC explicitly before calling SignIssuanceLicense.
4. Catch RightsManagementException and surface a user-facing message explaining the user lacks publishing rights.

Example fix

// before: blindly publish offline
var publishLicense = unsignedLicense.Publish(session);

// after: ensure a client licensor cert exists first
if (secureEnvironment.HasClientLicensorCert == false)
    throw new InvalidOperationException("No client licensor certificate for this user; configure AD RMS provisioning.");
var publishLicense = unsignedLicense.Publish(session);

bool canPublish = secureEnvironment != null && secureEnvironment.HasClientLicensorCert;
if (!canPublish) throw new InvalidOperationException("User has no client licensor certificate; cannot publish offline.");

catch (RightsManagementException ex) when (ex.Message.Contains("UserHasNoClientLicensorCert")) { /* prompt user to obtain publishing rights */ }

When it happens

Trigger: Calling ClientSession.SignIssuanceLicense (via UnsignedPublishLicense.Publish / PublishLicense flow) when DRMGetClientLicensorCertificate (native call inside GetClientLicensorCert) returns no certificate for the active user/session — e.g. the user has never been issued a CLC by the RMS server.

Common situations: RMS server not reachable or refusing to issue a client licensor certificate; user account not provisioned/licensed in the AD RMS deployment; running in an environment without Active Directory Rights Management Services; locked-down machine where the DRM indiewizard/secure pipeline can't store the certificate.

Related errors

• ArgumentOutOfRangeException(right)
• EncryptionNotPermitted
• InvalidLicense
• InvalidLicense
• InvalidLicense

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/b8c99dceeca3ac9f. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/Security/RightsManagement/ClientSession.cs:522

        {
            CheckDisposed();

            return GetLicenseOnSession(_hSession, enumerateLicenseFlags, index);
        }

        internal PublishLicense SignIssuanceLicense(IssuanceLicense issuanceLicense, out UseLicense authorUseLicense)
        {
            CheckDisposed();

            Invariant.Assert(issuanceLicense != null);
            Invariant.Assert(!_envHandle.IsInvalid);

            using (CallbackHandler signIssuanceLicenseCallbackHandler = new CallbackHandler())
            {
                string clientLicensorCertificate = GetClientLicensorCert();

                if (clientLicensorCertificate == null)
                    throw new RightsManagementException(SR.UserHasNoClientLicensorCert);

                // Trim all the leading and trailing white space characters
                // of the clientLicensorCertificate.
                clientLicensorCertificate = clientLicensorCertificate.Trim();

                // Make sure the clientLicensorCertificate is valid. By trimming white spaces
                // above, if the certificate string is empty or contains only white spaces, it
                // is empty now.
                if (clientLicensorCertificate.Length == 0)
                    throw new RightsManagementException(SR.UserHasNoClientLicensorCert);

                // Offline publishing supported no Online publishing support 
                int hr = SafeNativeMethods.DRMGetSignedIssuanceLicense(
                    _envHandle,
                    issuanceLicense.Handle,
                    (uint)(SignIssuanceLicenseFlags.Offline |
                                SignIssuanceLicenseFlags.AutoGenerateKey |
                                SignIssuanceLicenseFlags.OwnerLicenseNoPersist),

View on GitHub (pinned to 81131a70a4)