https://2011sg.poshcode.org/Auth/LogOn
Not sure what to do next, it seems that although you've got the SSL cert set up, the server can't access it, and so it can't encrypt cookies. I'll look into a different workaround in the morning, but what I normally do on our test server when we see this error is modify the ACL to give the app pool account access to the SSL certificate ...
InvalidOperationException: ID1074: A CryptographicException occurred when attempting to encrypt the cookie using the ProtectedData API (see inner exception for details). If you are using IIS 7.5, this could be due to the loadUserProfile setting on the Application Pool being set to false.
Any suggestions?
#1 Posted by Jaykul on 27 Mar, 2011 06:19 PM
Ok, I had to reconfigure this to not require SSL for now (so that people stop complaining that it's down), but I don't want to leave it this way, because users get the "are you sure you want to send this data from a secure site to an insecure site" prompt when they get redirected back from auth.poshcode.org to the 2011sg.poshcode.org site that's hosted here.
#2 Posted by Jaykul on 27 Mar, 2011 09:16 PM
... maybe it's actually a WIF problem? Maybe installing the WIF .msu on the server would help -- I can't figure out what else is different (I even changed my test server to not load profiles, etc).
#3 Posted by rune Support staff on 27 Mar, 2011 11:12 PM
Hi Joel,
Could you give us an example of some code that causes this behaviour? I'm curious as to how this can happen as cookies are not usually encrypted using the certificate.
Keep in mind that the certificate is not installed on the server that runs your code. We terminate SSL at the load balancer level and that's where the certificate resides.
Best,
Rune
#4 Posted by Jaykul on 28 Mar, 2011 03:31 AM
It's not actually my code, per-se -- the exception happens in Microsoft's code.
However, after reviewing, I don't think it's SSL related at all, I think it's Windows Identify Foundation.
My site works something like this: http://blogs.msdn.com/b/eugeniop/archive/2010/04/03/wif-and-mvc-how...
I'm using WIF to delegate authentication to http://auth.poshcode.org -- which is not running on SiteGround (yet). I get a Claim Token response which is handled by Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest ... and which eventually fails.
There's really no code of mine in the stack trace, it's all the WIF Module. The only thing I seem to have control over is the configuration of WIF. You can see in the attached file (or by trying to log on to my site http://2011sg.poshcode.org) right now (use your facebook or liveid). I'm happy to let you see my code & web config if you like (there's nothing secret about it, and it will all be open source once I get it working anyway).
There's some documentation of the exception ( ID1074 ) in http://consultingblogs.emc.com/simonevans/archive/2010/11/19/common... but the workaround that's proposed is not helpful. Not only did I try it, but I have this exact code working on my dev box (you can try that at http://jaykul.org/) without even setting loadUserProfile true (the only difference is a web.config transformation to switch the urls.
#5 Posted by Jaykul on 28 Mar, 2011 04:50 AM
OK, I think I've figured this out ... I did some research, because I couldn't remember what I knew about DPAPI ... long story short, DPAPI requires a profile, because that's how it stores the encryption keys. It's a really awkward choice, and won't work in a webfarm environment. Quote:
The default encryption strategy followed by WIF for session tokens is to use DPAPI, would create problems when the client interacts with multiple instances: a session token encrypted by a given instance would not be readable by any other.
I need a little guidance from you though, because the alternative that they recommend is to provide a custom SessionSecurityTokenHandler ... and they're recommending that I use RSA with "the service certificate" for securing the session token (an X509Certificate2 which they get via IServiceHost.Credentials.ServiceCertificate.Certificate) ... is there any chance that's going to work on AppHarbor?
#6 Posted by Jaykul on 28 Mar, 2011 05:08 AM
This is basically all I need -- I'm just not sure how to go about doing that on AppHarbor: http://www.leastprivilege.com/WCFWIFAndLoadBalancingAndABitOfAzure....
I found a sample in the SDK using RSA as well, but it's late, and I'm exhausted, and I can no longer think of any way to do this that doesn't involve access to a common cert across the web farm for handling the tokens.
Maybe in the morning I'll think of a way to do it by embedding a PGP key into the web config transform or something :-p
#7 Posted by Jaykul on 28 Mar, 2011 07:58 PM
I tried deploying a build using RSA instead of DPAPI but (as I expected) there's no Service Certificate, so that doesn't work either.
#8 Posted by Jaykul on 28 Mar, 2011 08:01 PM
Ok, I found a work around (sorta) by deploying an RSA key in my Web config (I'll try replacing with a clean one via your appSettings support later) and writing some custom code to create an RSA cookie token handler from that key instead of an x509 cert. This is rather hacky though.
#9 Posted by rune Support staff on 28 Mar, 2011 08:33 PM
Hi Joel,
Good to hear you found a solution to this. It does make sense that the key needs to a part of your codebase as it's not installed on the server. You would also have to use the same key for encrypting when or if you application is going to be deployed to multiple servers. I must admit that I'm not familar with WIF, so I can't really give any advice on that.
If you'd rather use an X509Certificate2 or think it'll be cleaner, you could always instantiate one from your public/private key. Don't know if you've tried that approach?
Best,
Rune
rune closed this discussion on 28 Mar, 2011 08:33 PM.