Saml2: Getting exception on server2008 r2 sp1 after update to .net 4.7.1

[markdemich]

I recently updated to .Net 4.7.1. I was on 4.5.1 and using Kentor. After the update, I started to get the following exception while processing the SAML response from the identity provider. The same code works perfectly on my Windows 10 box. Any ideas on a work around?

I updated to the Sustainsys/Saml2 and got the same error. I'm using IIS with the HttpModule.

[CryptographicException: An internal error occurred.
]
System.Security.Cryptography.NCryptNative.OpenStorageProvider(String providerName) +93
System.Security.Cryptography.CngKey.Import(Byte[] keyBlob, String curveName, CngKeyBlobFormat format, CngProvider provider) +237
System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPublicKey(X509Certificate2 certificate) +212
System.IdentityModel.Tokens.X509AsymmetricSecurityKey.get_PublicKey() +237
System.IdentityModel.Tokens.X509AsymmetricSecurityKey.GetAsymmetricAlgorithm(String algorithm, Boolean privateKey) +526
Sustainsys.Saml2.XmlHelpers.VerifySignature(IEnumerable1 signingKeys, SignedXml signedXml, XmlElement signatureElement, Boolean validateCertificate) +186 Sustainsys.Saml2.XmlHelpers.IsSignedByAny(XmlElement xmlElement, IEnumerable1 signingKeys, Boolean validateCertificate, String minimumSigningAlgorithm) +166
Sustainsys.Saml2.Saml2P.<>c__DisplayClass54_0.b__0(XmlElement a) +59
System.Linq.Enumerable.Any(IEnumerable1 source, Func2 predicate) +176
Sustainsys.Saml2.Saml2P.Saml2Response.ValidateSignature(IOptions options) +299
Sustainsys.Saml2.Saml2P.d__59.MoveNext() +129
System.Collections.Generic.List1..ctor(IEnumerable1 collection) +436
System.Linq.Enumerable.ToList(IEnumerable`1 source) +69
Sustainsys.Saml2.Saml2P.Saml2Response.GetClaims(IOptions options) +217
Sustainsys.Saml2.WebSso.AcsCommand.ProcessResponse(IOptions options, Saml2Response samlResponse, StoredRequestState storedRequestState) +52
Sustainsys.Saml2.WebSso.AcsCommand.Run(HttpRequestData request, IOptions options) +871
Sustainsys.Saml2.HttpModule.Saml2AuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs e) +365
System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +223
System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step) +213
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +91

[nicswan]

After your updates did you provide updated metadata to your identity provider? Can you provide more info about your configuration?

[markdemich]

Sorry, for some reason, I didn't get an email notification. Otherwise I would have responded sooner.

I'm not sure I had to provide "updated metadata" since I got this working on my Windows 10 server. I published the same code to my 2008 server and I get that exception.

If it helps, I know the server is sending back in SHA-1 so I had to set this property in the sustainsys.saml2 element. minIncomingSigningAlgorithm="SHA1"

I found this post that seems it may be related. They talk about setting "Load User Profile" in the app pool to true, but I tried that and it didn't help.

https://github.com/Microsoft/dotnet/issues/341

[markdemich]

I had one of my developers test our app with .Net 4.7.1 on Windows 7 and it's working ok. There is either something with Server 2008 or that particular server. I will try to run it on another windows server 2008 to see if I get the same issue.

[markdemich]

I found the root cause of this problem I was having.

The clue was in the post.
https://blogs.msdn.microsoft.com/dsnotes/2012/08/17/cngkey-import-throws-an-exception-saying-an-internal-error-occurred-when-importing-a-key-blob-under-a-non-admin-user-from-a-wcf-web-service/

By manually starting the CNG Key Isolation service, it fixed the problem. For now, I'm setting it to auto start when the machine boots. That should take care of it.