IIS应用程序上的ProtectedData.Unprotect-IISRESET后无法工作

问题描述

我需要从本地数据库存储和检索敏感数据-该数据由Web应用程序使用.

I need to store and retrieve sensitive data from a local database - this data is used by a web application.

为了保护所说的数据，我选择使用ProtectedData类.

In order to protect said data I've opted to make use of the ProtectedData class.

IIS应用程序正在使用特定的AD用户(高级设置"中的身份"属性)运行.

The IIS application is running using a specific AD user (Identity property in the Advanced Settings).

一切正常，直到我执行IISRESET为止-在这一点上，似乎出于ProtectedData类的目的更改了标识，并且剩下了无法解密的数据-我得到了Key not valid for use in specified state例外.

Everything works fine until I do an IISRESET - at this point, it seems that the identity is changed for the purposes of the ProtectedData class, and I'm left with data I cannot decrypt - I'm getting a Key not valid for use in specified state exception.

这是我正在使用的代码:

Here's the code I'm using:

    static public string Encrypt(string data)
    {
        var encryptedData = ProtectedData.Protect(System.Text.Encoding.UTF8.GetBytes(data), entropy, DataProtectionScope.CurrentUser);
        return Convert.ToBase64String(encryptedData);
    }

    static public string Decrypt(string base64string)
    {
        var encryptedData = Convert.FromBase64String(base64string);
        return System.Text.Encoding.UTF8.GetString(ProtectedData.Unprotect(encryptedData, entropy, DataProtectionScope.CurrentUser));
    }

entropy对于我的应用程序显然是静态的.

The entropy is obviously static for my application.

这是怎么回事?我的印象是，DataProtectionScope.CurrentUser会使用顾名思义的当前用户-就我所知，该用户应为应用程序池标识.为什么当我执行IISRESET时看起来好像被改变了?

What's going on? I was under the impression that DataProtectionScope.CurrentUser will use, as the name implies, the current user - which should be, to my knowledge, the application pool identity. Why does it seem like this is changed when I perform an IISRESET?

推荐答案

虽然我不知道为什么会发生这种情况，但我更改了代码以使用AES加密-可以正常工作.

Whilst I don't know why this was happening, I changed the code to use AES encryption instead - this is working fine.

虽然不能说出问题的答案，但我认为这是一个有效的解决方法，值得一提.

While not an answer to the problem per-say I think it's a valid workaround that deserves mentioning.

编辑:

我认为我已经找到了导致问题的原因(我仍然不知道为什么会这样，但是今天我确实注意到了一些事情.)

I think I've found what was causing the issue (I still don't exactly know WHY this is happening, but I did notice something today).

如果Web应用程序使用的是 ApplicationPool 标识，那么一切都很好，并且在IISRESET之后DPAPI应该继续工作. 但是，如果我将身份更改为AD中定义的特定用户，那么在回收应用程序池之后事情就变得一团糟.

If the web application is using the ApplicationPool identity, then all is fine and well and DPAPI should continue working after an IISRESET. However if I change the identity to a specific user defined in AD, then things go haywire after the application pool is recycled.

对我来说幸运的是，在这种特殊情况下，我不再需要特定的AD用户，并且主要加密仅基于DPAPI，并且基于AES(当负载平衡成为问题时，DPAPI不​​能用于访问共享资源)用于加密AES密钥的本地副本.

Lucky for me In this particular case I neither need a specific AD user any more and the main encryption is based on AES (DPAPI can't be used to access a shared resource when load balancing comes into the equation) with DPAPI only being used to encrypt the local copy of the AES keys.

这篇关于IIS应用程序上的ProtectedData.Unprotect-IISRESET后无法工作的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！