The data protection operation was unsuccessful on Azure using OWIN / Katana

Question

I'm trying to implement password reset on an OWIN/Katana based ASP.NET MVC website running in Azure.

It works fine when run locally but fails in production.

I create a UserToken Provider

userManager.UserTokenProvider = new DataProtectorTokenProvider<ApplicationUser>(provider.Create("PasswordReset"))

But when I attempt to generate the token as follows

var resetToken = await UserManager.GeneratePasswordResetTokenAsync(user.Id);

I get following exception.

System.Security.Cryptography.CryptographicException: The data protection operation was unsuccessful. This may have been caused by not having the user profile loaded for the current thread's user context, which may be the case when the thread is impersonating. at System.Security.Cryptography.ProtectedData.Protect(Byte[] userData, Byte[] optionalEntropy, DataProtectionScope scope) at System.Security.Cryptography.DpapiDataProtector.ProviderProtect(Byte[] userData) at System.Security.Cryptography.DataProtector.Protect(Byte[] userData) at Microsoft.Owin.Security.DataProtection.DpapiDataProtector.Protect(Byte[] userData) at Microsoft.AspNet.Identity.Owin.DataProtectorTokenProvider 2.d__0.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.AspNet.Identity.UserManager`2.d__e9.MoveNext()

Acrogen

did you found the solution yet ? – Clipboard

yes I found a workaround but I'm not totally satisfy. It seems it's due to the AppName parameter which is not the same everywhere in the application. So I used app parameters of Configuration(IAppBuilder app) call from OwinStartupAttribute to instanciate the IDataPRovider and it seems to work. To get the dataprovider object you can do it like so : app.GetDataProtectionProvider(). Tell me if it work – Clipboard

Please vote on the issue aspnetidentity.codeplex.com/workitem/2439 to get this fixed. – Allogamy

Answer 1

If the host server is a virtual machine it could be exactly what the error message says. Check if your Application Pool in IIS really has Load User Profile set to true like the exception says:

• In the Connections pane, expand the server name, and then click Application Pools.
• Right click on you Pool
• Advanced Settings

Skinny

worked for #AWS also... thank you! Fixes error ``` The data protection operation was unsuccessful. This may have been caused by not having the user profile loaded for the current thread’s user context, which may be the case when the thread is impersonating. ``` – Idiographic

with above screenshot solved my problem. Thanks – Multitude

Worked on a WS-Fed call for Authentication and Authorization after publishing a web site. – Stoichiometric

Answer 2

I have the same problem when I try to generate token with ASP .Net identity and custom login function in Web API.

"The data protection operation was unsuccessful. This may have been caused by not having the user profile loaded for the current thread's user context, which may be the case when the thread is impersonating."

What I did is just simply create an Application Setting called WEBSITE_LOAD_USER_PROFILE in Microsoft Azure and set it to 1. That solution works for me.

You can see the detail here

Osullivan

simplest solution here, and just like the link says, I needed to avoid BASIC and SHARED plans for this settings to apply. – Triphibious

Answer 3

Please see my my answer to this question. A much simpler solution can be achieved by utilizing IAppBuilder.GetDataProtectionProvider()

Gallinaceous

Answer 4

I found a solution. I'm not exactly sure if all steps are necessary to it work, but now my app works perfectly:

1.- Update your web.config to support securityTokenHandlers

<section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
<section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>

in the configSections node. And

  <securityTokenHandlers>
    <remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler,
                System.IdentityModel, Version=4.0.0.0, Culture=neutral,
                PublicKeyToken=B77A5C561934E089" />

    <add
      type="System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler,
          System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral,
          PublicKeyToken=B77A5C561934E089">
      <sessionTokenRequirement lifetime="00:30:00"></sessionTokenRequirement>
    </add>
  </securityTokenHandlers>

</identityConfiguration>

as a regular node. 2.- In your Startup.Auth.cs file, update your ConfigureAuth(IAppBuilder app) like this:

public void ConfigureAuth(IAppBuilder app)
        {

            UserManagerFactory = () =>
            {
                var userManager = new UserManager<SIAgroUser>(new UserStore<UserType>(new SIAgroUserDbContext()));

                IDataProtectionProvider provider = app.GetDataProtectionProvider();

                //userManager.UserTokenProvider = new Microsoft.AspNet.Identity.Owin.DataProtectorTokenProvider<UserType>(provider.Create("PasswordReset") );
                if (provider != null)
                {
                    userManager.UserTokenProvider = new DataProtectorTokenProvider<UsertType, string>(provider.Create("PasswordReset"));
                }

                return userManager;
            };

            OAuthOptions = new OAuthAuthorizationServerOptions
            {
                TokenEndpointPath = new PathString("/Token"),
                Provider = new ApplicationOAuthProvider(PublicClientId, UserManagerFactory),
                AuthorizeEndpointPath = new PathString("/api/Account/ExternalLogin"),
                AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
                AllowInsecureHttp = true
            };
            // Enable the application to use a cookie to store information for the signed in user
            // and to use a cookie to temporarily store information about a user logging in with a third party login provider
            app.UseCookieAuthentication(new CookieAuthenticationOptions());
            app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

            // Enable the application to use bearer tokens to authenticate users
            app.UseOAuthBearerTokens(OAuthOptions);

            // Uncomment the following lines to enable logging in with third party login providers
            //app.UseMicrosoftAccountAuthentication(
            //    clientId: "",
            //    clientSecret: "");

            //app.UseTwitterAuthentication(
            //    consumerKey: "",
            //    consumerSecret: "");

            //app.UseFacebookAuthentication(
            //    appId: "",
            //    appSecret: "");

            //app.UseGoogleAuthentication();



        }

3.- Clean up the constructor of your Startup class like this:

static Startup()
{
   PublicClientId = "self";
}

That worked for me :) I hope it works for you too

Bruit

I think just this part is important : IDataProtectionProvider provider = app.GetDataProtectionProvider(); Like I said in my previous comment, I think it's a problem with the AppName. If you instantiate by your self the dataprotection provider you will set a different name than the Application name it use... – Clipboard

And I think that to use Owin context to instantiate user manager is better if you don't use any IOS : app.CreatePerOwinContext(ExtranetDbContext.Create); app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create); – Clipboard

Answer 5

This error happens for me on a shared hosting provider, at the line:

var provider = new DpapiDataProtectionProvider("SITENAME");

The solution was quite simple. First change the above line to this:

var provider = new MachineKeyProtectionProvider();

Then create a new file, which I have in my Utilities namespace, like so:

using Microsoft.Owin.Security.DataProtection;
using System.Web.Security;

namespace <yournamespace>.Utilities
{
    public class MachineKeyProtectionProvider : IDataProtectionProvider
    {
        public IDataProtector Create(params string[] purposes)
        {
            return new MachineKeyDataProtector(purposes);
        }
    }

    public class MachineKeyDataProtector : IDataProtector
    {
        private readonly string[] _purposes;

        public MachineKeyDataProtector(string[] purposes)
        {
            _purposes = purposes;
        }

        public byte[] Protect(byte[] userData)
        {
            return MachineKey.Protect(userData, _purposes);
        }

        public byte[] Unprotect(byte[] protectedData)
        {
            return MachineKey.Unprotect(protectedData, _purposes);
        }
    }
}

Et voila! Problem solved. Just remember, in your password reset controller method, you will also have to use this provider, otherwise you will get an Invalid Token error.

Aquamarine

Answer 6

I put this one on ice for a while but was forced to come back to it. I found the solution here: Generating reset password token does not work in Azure Website

Acrogen

Answer 7

Getting the UserManager from the Owin Pipeline, as its set in App_Start/Startup.Auth.cs, works on Azure. I'm unsure as to how this works specifically. The DpApi should work in Azure with the solution described in the first link.

If the DpApi has a static machine key set in Web.config all server machines will be able to decrypt the encrypted data created by another machine in your webfarm is the understanding behind this.

(code as given in the standard template - from AccountController.cs)

 private UserManager userManager;
    public UserManager UserManager
    {
        get { return userManager ?? HttpContext.GetOwinContext().GetUserManager<UserManager>(); }
        private set { userManager = value; }
    }

Missive

Answer 8

After me and two other people have messing with this error for dayS we discovered something intresting in the IIS. If the Load User Profile is switched following is created in applicationhost.config

loadUserProfile="true"

but when you turn it off it also works, but now the line

loadUserProfile="false"

has been added. So difference was that default value had to be written in applicationhost.config to make it work. Some cache is recreated?

Somnambulism