Saml2: Key not valid for use in specified state - possible load balancer issue?

[themartinhawkins]

Hi,

We're running Kentor in its standalone HTTP module form - enabling options via web.config only. After authentication the site redirects to our app via an existing silent logon process.

Anyway, I'm getting the exception below reported by some clients as an intermittent issue. I thought it was linked to our use of a load balancer (where a subsequent visit from a user ends up hitting the node that didn't originally authenticate them - we have just two nodes and the SAML site is hosted on both behind a load balancer). Does that seem like a likely cause? I'm struggling with finding a solution and have just installed v0.18.0 without change.

If there is load balancer related configuration or a way of setting up the SAML site (powered by Kentor) to handle this better I would be very grateful of any assistance. I have been Googling without much luck.

Thanks,
Martin.

Process information:
Process ID: 5600
Process name: w3wp.exe
Account name: NT AUTHORITY\NETWORK SERVICE

Exception information:
Exception type: CryptographicException
Exception message: Key not valid for use in specified state.
at System.Security.Cryptography.ProtectedData.Unprotect(Byte[] encryptedData, Byte[] optionalEntropy, DataProtectionScope scope)
at System.IdentityModel.ProtectedDataCookieTransform.Decode(Byte[] encoded)

Request information:
Request URL: /auth/saml/Acs
Request path: /auth/saml/Acs
User host address:
User:
Is authenticated: False
Authentication Type:
Thread account name: NT AUTHORITY\NETWORK SERVICE

Thread information:
Thread ID: 10
Thread account name: NT AUTHORITY\NETWORK SERVICE
Is impersonating: False
Stack trace: at System.Security.Cryptography.ProtectedData.Unprotect(Byte[] encryptedData, Byte[] optionalEntropy, DataProtectionScope scope)
at System.IdentityModel.ProtectedDataCookieTransform.Decode(Byte[] encoded)

Custom event details: 675702-web2/Application Context

[AndersAbel]

It might be a load balancer issue. Have you set the same MachineKey for all the servers in the farm?

I also found an old issue in IdSrv2 that suggests it might be because of users having old cookies remaining in their browsers. Could that be the case?

[themartinhawkins]

Yes, the MachineKey is set the same for both nodes.

It shouldn't be cookie related - we haven't upgraded any of our server settings of late. I did also ask them to try without cookies or deleting any that exist just to eliminate them and they reported the same issue.

Incidentally, we have a separate setup that sees a lot more SAML authentication traffic and is load balanced and a quick search of the logs shows that this error is not occurring. I don't know if that means our clients are doing something strange or we are at this point...

Appreciate the help!

[AndersAbel]

Googling for System.IdentityModel.ProtectedDataCookieTransform.Decode shows a stack trace that comes from the SessionAuthenticationModule and not specifically AuthServices. Which makes sense, because there's no call directly to ProtectedDataCookieTransform in AuthServices.

Looks like there might be some work required when running the SessionAuthenticationModule in a load balancer setup. Looks like just setting the same MachineKey is not enough.

The encryption done by AuthServices for preserving state of send AuthnRequests uses the MachineKey directly and as you're not seeing issues from that the MachineKey config should be fine.

[AndersAbel]

Closing due to inactivity. Please comment if you want to reopen.

[themartinhawkins]

Sorry, I meant to update here. We were actually missing some config to use the machineKeys - removing the default handler and specifying the machineKey token handler. Adding this to our web configs for the SAML app on all nodes fixed the issue. Adding the info here in case anyone else gets stuck.

  <system.identityModel>
    <identityConfiguration>
      <securityTokenHandlers>
        <remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
        <add type="System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
      </securityTokenHandlers>
    </identityConfiguration>
  </system.identityModel>

(Source: https://msdn.microsoft.com/en-us/library/hh545457(v=vs.110).aspx)

Thanks for your pointers, Anders.