{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/DataProtection/issues/107","labels_url":"https://api.github.com/repos/aspnet/DataProtection/issues/107/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/DataProtection/issues/107/comments","events_url":"https://api.github.com/repos/aspnet/DataProtection/issues/107/events","html_url":"https://github.com/aspnet/DataProtection/issues/107","id":117414048,"number":107,"title":"Data Protection on IIS hosted web sites needs configuration","user":{"login":"blowdart","id":796298,"avatar_url":"https://avatars.githubusercontent.com/u/796298?v=3","gravatar_id":"","url":"https://api.github.com/users/blowdart","html_url":"https://github.com/blowdart","followers_url":"https://api.github.com/users/blowdart/followers","following_url":"https://api.github.com/users/blowdart/following{/other_user}","gists_url":"https://api.github.com/users/blowdart/gists{/gist_id}","starred_url":"https://api.github.com/users/blowdart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blowdart/subscriptions","organizations_url":"https://api.github.com/users/blowdart/orgs","repos_url":"https://api.github.com/users/blowdart/repos","events_url":"https://api.github.com/users/blowdart/events{/privacy}","received_events_url":"https://api.github.com/users/blowdart/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aspnet/DataProtection/labels/discussion","name":"discussion","color":"5319e7"}],"state":"open","locked":false,"assignee":{"login":"blowdart","id":796298,"avatar_url":"https://avatars.githubusercontent.com/u/796298?v=3","gravatar_id":"","url":"https://api.github.com/users/blowdart","html_url":"https://github.com/blowdart","followers_url":"https://api.github.com/users/blowdart/followers","following_url":"https://api.github.com/users/blowdart/following{/other_user}","gists_url":"https://api.github.com/users/blowdart/gists{/gist_id}","starred_url":"https://api.github.com/users/blowdart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blowdart/subscriptions","organizations_url":"https://api.github.com/users/blowdart/orgs","repos_url":"https://api.github.com/users/blowdart/repos","events_url":"https://api.github.com/users/blowdart/events{/privacy}","received_events_url":"https://api.github.com/users/blowdart/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/aspnet/DataProtection/milestones/16","html_url":"https://github.com/aspnet/DataProtection/milestones/Discussions","labels_url":"https://api.github.com/repos/aspnet/DataProtection/milestones/16/labels","id":1416585,"number":16,"title":"Discussions","description":"","creator":{"login":"Eilon","id":202643,"avatar_url":"https://avatars.githubusercontent.com/u/202643?v=3","gravatar_id":"","url":"https://api.github.com/users/Eilon","html_url":"https://github.com/Eilon","followers_url":"https://api.github.com/users/Eilon/followers","following_url":"https://api.github.com/users/Eilon/following{/other_user}","gists_url":"https://api.github.com/users/Eilon/gists{/gist_id}","starred_url":"https://api.github.com/users/Eilon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Eilon/subscriptions","organizations_url":"https://api.github.com/users/Eilon/orgs","repos_url":"https://api.github.com/users/Eilon/repos","events_url":"https://api.github.com/users/Eilon/events{/privacy}","received_events_url":"https://api.github.com/users/Eilon/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":0,"state":"open","created_at":"2015-11-17T20:05:50Z","updated_at":"2015-11-17T20:07:28Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2015-11-17T18:04:20Z","updated_at":"2015-11-17T20:37:23Z","closed_at":null,"body":"When hosted a website behind IIS the Data Protection stack does not find a suitable place to store the keyring, and uses in memory keys. This means that when your application restarts all forms authentication tokens will be invalid and users will have to login again. In addition any data you protected will no longer be able to be unprotected.\r\n\r\nThis **does not** apply to IIS Express.\r\n\r\nTo configure Data Protection under IIS you must either \r\n\r\n* Run a [powershell script](https://github.com/aspnet/DataProtection/blob/dev/Provision-AutoGenKeys.ps1) to create suitable registry entries (Usage `.\\Provision-AutoGenKeys.ps1 DefaultAppPool`). This will store keys in the registry, protected using DPAPI with a machine wide key.\r\n* Configure the IIS Application Pool to load the user profile. This setting is in the Process Model section under the Advanced Settings for the application pool. Set Load User Profile to True. This will store keys under the user profile directory, and protected using DPAPI with a key specific to the user account used for the app pool.\r\n* Adjust your application code to [use the file system as a key ring store](https://docs.asp.net/en/latest/security/data-protection/configuration/overview.html). If you do this you should use an X509 certificate to protect the key ring and ensure it is a trusted certificate, i.e. if it is a self signed certificate you must place it in the Trusted Root store."},"comment":{"url":"https://api.github.com/repos/aspnet/DataProtection/issues/comments/157499183","html_url":"https://github.com/aspnet/DataProtection/issues/107#issuecomment-157499183","issue_url":"https://api.github.com/repos/aspnet/DataProtection/issues/107","id":157499183,"user":{"login":"blowdart","id":796298,"avatar_url":"https://avatars.githubusercontent.com/u/796298?v=3","gravatar_id":"","url":"https://api.github.com/users/blowdart","html_url":"https://github.com/blowdart","followers_url":"https://api.github.com/users/blowdart/followers","following_url":"https://api.github.com/users/blowdart/following{/other_user}","gists_url":"https://api.github.com/users/blowdart/gists{/gist_id}","starred_url":"https://api.github.com/users/blowdart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blowdart/subscriptions","organizations_url":"https://api.github.com/users/blowdart/orgs","repos_url":"https://api.github.com/users/blowdart/repos","events_url":"https://api.github.com/users/blowdart/events{/privacy}","received_events_url":"https://api.github.com/users/blowdart/received_events","type":"User","site_admin":false},"created_at":"2015-11-17T20:37:23Z","updated_at":"2015-11-17T20:37:23Z","body":"That would be to use a file share all machines can access, and then deploy an X509 certificate to each machine. You would have to [configure that in code](https://docs.asp.net/en/latest/security/data-protection/configuration/overview.html). "}}