Signalr: Problem with SignalR and ASP.NET impersonation

[NichUK]

We're running an application with , and since upgrading SignalR from RC2 has started failing on the server (although it runs OK on dev machines).

From the exception we're logging (below) it would appear that it's a Data Protection error, and it looks like it's something to do with signing connection ID's which has come in between RC2 and release.

There doesn't appear to be any way to switch off this new behaviour, and it looks like we'd have to try loading User Profile Data in an HttpModule in order to get it done before SignalR tried to use it which also adds significant complexity.

We've downgraded back to RC2 for the moment, although we're suffering with a client-side (JS) memory leak in this, which we are hopeful is fixed in the release version.

Interestingly, even with an additional location element handling the signalr path, and impersonate set to false within it, we still get an error, although it acknowledges that impersonation is no longer happening. (second exception below).

Do you have any other suggestions? Can we suggest that a configurable way of switching off this behaviour might be useful.

Initial Exception - Impersonation On

Log Name: Application
Source: ASP.NET 4.0.30319.0
Date: 25/02/2013 21:39:16
Event ID: 1309
Task Category: Web Event
Level: Warning
Keywords: Classic
User: N/A
Computer: CIE-PORTAL001.newshield.test
Description:
Event code: 3005 Event message: An unhandled exception has occurred. Event time: 25/02/2013 21:39:16 Event time (UTC): 25/02/2013 21:39:16 Event ID: 7c35f72faf084a0ba22234f8365233ef Event sequence: 274 Event occurrence: 3 Event detail code: 0 Application information: Application domain: /LM/W3SVC/1/ROOT-1-130063017414433060 Trust level: Full Application Virtual Path: / Application Path: C:\inetpub\wwwroot\ Machine name: CIE-PORTAL001 Process information: Process ID: 2912 Process name: w3wp.exe Account name: IIS APPPOOL\CIE_User_Portal Exception information: Exception type: CryptographicException Exception message: The data protection operation was unsuccessful. This may have been caused by not having the user profile loaded for the current thread's user context, which may be the case when the thread is impersonating.

Server stack trace:
at System.Security.Cryptography.ProtectedData.Protect(Byte[] userData, Byte[] optionalEntropy, DataProtectionScope scope)
at Microsoft.AspNet.SignalR.Infrastructure.DefaultProtectedData.Protect(String data, String purpose)
at Microsoft.AspNet.SignalR.PersistentConnection.ProcessNegotiationRequest(HostContext context)
at Microsoft.AspNet.SignalR.Owin.CallHandler.Invoke(IDictionary2 environment) at Microsoft.AspNet.SignalR.Owin.Handlers.HubDispatcherHandler.Invoke(IDictionary2 environment)
at Microsoft.Owin.Host.SystemWeb.OwinCallContext.Execute()
at Microsoft.Owin.Host.SystemWeb.OwinHttpHandler.BeginProcessRequest(HttpContextBase httpContext, AsyncCallback callback, Object extraData)

Exception rethrown at [0]:
at Microsoft.Owin.Host.SystemWeb.Utils.<>c__DisplayClass1.b__0(Exception ex)
at Microsoft.Owin.Host.SystemWeb.CallContextAsyncResult.End(IAsyncResult result)
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Request information: Request URL: http://manage.newshield.test/signalr/negotiate?_=1361828348805 Request path: /signalr/negotiate User host address: x.x.x.x User: NEWSHIELD\XXXXX Is authenticated: True Authentication Type: Negotiate Thread account name: IIS APPPOOL\CIE_User_Portal Thread information: Thread ID: 20 Thread account name: IIS APPPOOL\CIE_User_Portal Is impersonating: True Stack trace: at Microsoft.Owin.Host.SystemWeb.Utils.<>c__DisplayClass1.b__0(Exception ex)
at Microsoft.Owin.Host.SystemWeb.CallContextAsyncResult.End(IAsyncResult result)
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Custom event details:
Event Xml:



1309
3
3
0x80000000000000

4294
Application
CIE-PORTAL001.newshield.test



3005
An unhandled exception has occurred.
25/02/2013 21:39:16
25/02/2013 21:39:16
7c35f72faf084a0ba22234f8365233ef
274
3
0
/LM/W3SVC/1/ROOT-1-130063017414433060
Full
/
C:\inetpub\wwwroot
CIE-PORTAL001


2912
w3wp.exe
IIS APPPOOL\CIE_User_Portal
CryptographicException
The data protection operation was unsuccessful. This may have been caused by not having the user profile loaded for the current thread's user context, which may be the case when the thread is impersonating.

Server stack trace:
at System.Security.Cryptography.ProtectedData.Protect(Byte[] userData, Byte[] optionalEntropy, DataProtectionScope scope)
at Microsoft.AspNet.SignalR.Infrastructure.DefaultProtectedData.Protect(String data, String purpose)
at Microsoft.AspNet.SignalR.PersistentConnection.ProcessNegotiationRequest(HostContext context)
at Microsoft.AspNet.SignalR.Owin.CallHandler.Invoke(IDictionary2 environment) at Microsoft.AspNet.SignalR.Owin.Handlers.HubDispatcherHandler.Invoke(IDictionary2 environment)
at Microsoft.Owin.Host.SystemWeb.OwinCallContext.Execute()
at Microsoft.Owin.Host.SystemWeb.OwinHttpHandler.BeginProcessRequest(HttpContextBase httpContext, AsyncCallback callback, Object extraData)

Exception rethrown at [0]:
at Microsoft.Owin.Host.SystemWeb.Utils.<>c__DisplayClass1.<GetRethrowWithNoStackLossDelegate>b__0(Exception ex)
at Microsoft.Owin.Host.SystemWeb.CallContextAsyncResult.End(IAsyncResult result)
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

http://manage.newshield.test/signalr/negotiate?_=1361828348805
/signalr/negotiate
172.21.5.121
NEWSHIELD\Ldavies
True
Negotiate
IIS APPPOOL\CIE_User_Portal
20
IIS APPPOOL\CIE_User_Portal
True
at Microsoft.Owin.Host.SystemWeb.Utils.<>c__DisplayClass1.<GetRethrowWithNoStackLossDelegate>b__0(Exception ex)
at Microsoft.Owin.Host.SystemWeb.CallContextAsyncResult.End(IAsyncResult result)
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Second Exception - Impersonation disabled for path signalr

Log Name: Application
Source: ASP.NET 4.0.30319.0
Date: 25/02/2013 23:53:35
Event ID: 1309
Task Category: Web Event
Level: Warning
Keywords: Classic
User: N/A
Computer: CIE-PORTAL001.newshield.test
Description:
Event code: 3005 Event message: An unhandled exception has occurred. Event time: 25/02/2013 23:53:35 Event time (UTC): 25/02/2013 23:53:35 Event ID: 07f66d91c0e449eaa2a31c1711a87d23 Event sequence: 128 Event occurrence: 1 Event detail code: 0 Application information: Application domain: /LM/W3SVC/1/ROOT-2-130063099703169507 Trust level: Full Application Virtual Path: / Application Path: C:\inetpub\wwwroot\ Machine name: CIE-PORTAL001 Process information: Process ID: 2912 Process name: w3wp.exe Account name: IIS APPPOOL\CIE_User_Portal Exception information: Exception type: CryptographicException Exception message: The data protection operation was unsuccessful. This may have been caused by not having the user profile loaded for the current thread's user context, which may be the case when the thread is impersonating.

Server stack trace:
at System.Security.Cryptography.ProtectedData.Protect(Byte[] userData, Byte[] optionalEntropy, DataProtectionScope scope)
at Microsoft.AspNet.SignalR.Infrastructure.DefaultProtectedData.Protect(String data, String purpose)
at Microsoft.AspNet.SignalR.PersistentConnection.ProcessNegotiationRequest(HostContext context)
at Microsoft.AspNet.SignalR.Owin.CallHandler.Invoke(IDictionary2 environment) at Microsoft.AspNet.SignalR.Owin.Handlers.HubDispatcherHandler.Invoke(IDictionary2 environment)
at Microsoft.Owin.Host.SystemWeb.OwinCallContext.Execute()
at Microsoft.Owin.Host.SystemWeb.OwinHttpHandler.BeginProcessRequest(HttpContextBase httpContext, AsyncCallback callback, Object extraData)

Exception rethrown at [0]:
at Microsoft.Owin.Host.SystemWeb.Utils.<>c__DisplayClass1.b__0(Exception ex)
at Microsoft.Owin.Host.SystemWeb.CallContextAsyncResult.End(IAsyncResult result)
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Request information: Request URL: http://manage.newshield.test/signalr/negotiate?_=1361836418755 Request path: /signalr/negotiate User host address: x.x.x.x User: NEWSHIELD\XXXXX Is authenticated: True Authentication Type: Negotiate Thread account name: IIS APPPOOL\CIE_User_Portal Thread information: Thread ID: 45 Thread account name: IIS APPPOOL\CIE_User_Portal Is impersonating: False Stack trace: at Microsoft.Owin.Host.SystemWeb.Utils.<>c__DisplayClass1.b__0(Exception ex)
at Microsoft.Owin.Host.SystemWeb.CallContextAsyncResult.End(IAsyncResult result)
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Custom event details:
Event Xml:



1309
3
3
0x80000000000000

4298
Application
CIE-PORTAL001.newshield.test



3005
An unhandled exception has occurred.
25/02/2013 23:53:35
25/02/2013 23:53:35
07f66d91c0e449eaa2a31c1711a87d23
128
1
0
/LM/W3SVC/1/ROOT-2-130063099703169507
Full
/
C:\inetpub\wwwroot
CIE-PORTAL001


2912
w3wp.exe
IIS APPPOOL\CIE_User_Portal
CryptographicException
The data protection operation was unsuccessful. This may have been caused by not having the user profile loaded for the current thread's user context, which may be the case when the thread is impersonating.

Server stack trace:
at System.Security.Cryptography.ProtectedData.Protect(Byte[] userData, Byte[] optionalEntropy, DataProtectionScope scope)
at Microsoft.AspNet.SignalR.Infrastructure.DefaultProtectedData.Protect(String data, String purpose)
at Microsoft.AspNet.SignalR.PersistentConnection.ProcessNegotiationRequest(HostContext context)
at Microsoft.AspNet.SignalR.Owin.CallHandler.Invoke(IDictionary2 environment) at Microsoft.AspNet.SignalR.Owin.Handlers.HubDispatcherHandler.Invoke(IDictionary2 environment)
at Microsoft.Owin.Host.SystemWeb.OwinCallContext.Execute()
at Microsoft.Owin.Host.SystemWeb.OwinHttpHandler.BeginProcessRequest(HttpContextBase httpContext, AsyncCallback callback, Object extraData)

Exception rethrown at [0]:
at Microsoft.Owin.Host.SystemWeb.Utils.<>c__DisplayClass1.<GetRethrowWithNoStackLossDelegate>b__0(Exception ex)
at Microsoft.Owin.Host.SystemWeb.CallContextAsyncResult.End(IAsyncResult result)
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

http://manage.newshield.test/signalr/negotiate?_=1361836418755
/signalr/negotiate
x.x.x.x
NEWSHIELD\Ldavies
True
Negotiate
IIS APPPOOL\CIE_User_Portal
45
IIS APPPOOL\CIE_User_Portal
False
at Microsoft.Owin.Host.SystemWeb.Utils.<>c__DisplayClass1.<GetRethrowWithNoStackLossDelegate>b__0(Exception ex)
at Microsoft.Owin.Host.SystemWeb.CallContextAsyncResult.End(IAsyncResult result)
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

[davidfowl]

So you're seeing issues because older clients are broken? Why is it working fine on dev machines? Can you repro this in a new project.

[NichUK]

Shouldn’t be older clients, I upgraded everything all together… from RS2 to 1.0.0.

I believe that the dev machine is OK, because we’re logged in, and browsing, and impersonating all in the same user. I haven’t done any further testing on that yet.

If I get a chance, I’ll try and repro in a new project, but I’ve got a drop-dead delivery date of Friday for this prototype, so I’m a bit pressed for time this week.

From: David Fowler [mailto:[email protected]]
Sent: 26 February 2013 00:41
To: SignalR/SignalR
Cc: Nich Overend
Subject: Re: [SignalR] Problem with SignalR and ASP.NET impersonation (#1591)

So you're seeing issues because older clients are broken? Why is it working fine on dev machines? Can you repro this in a new project.

—
Reply to this email directly or view it on GitHubhttps://github.com/SignalR/SignalR/issues/1591#issuecomment-14085816.

[davidfowl]

I'm seeing some surprising things in the code, so if you could create a repro project with repro steps it would be awesome.

Here's some things that look suspicious:

• DefaultProtectedData should never be used in an ASP.NET app unless you're doing something really strange
• The connectionToken is generated using a random connection id + user identity so it must be the same data across the connection. Whatever your module is doing needs to happen per http request to the signalr apis

[vladkosarev]

We had this ProtectedData exception too. We reverted to rc2 and we are back to working SignalR.
With release version, client was getting 403s on POSTs for some reason, with rc2 POSTs work just fine.
We use Basic and Anonymous Auth on the web api site where we host signalr. We are running ARR that rewrites signalr calls to web api -

                <rule name="Signalr">
                    <match url="^signalr(.*)" />
                    <action type="Rewrite" url="https://ourwebapisite/signalr{R:1}" />
                </rule>

We use Autofac 3 and this Resolver code -

``` c#
public class SignalRDependencyResolver : DefaultDependencyResolver, IRegistrationSource
{
private readonly ILifetimeScope _lifetimeScope;

    public SignalRDependencyResolver(ILifetimeScope lifetimeScope)
    {
        _lifetimeScope = lifetimeScope;
        _lifetimeScope.ComponentRegistry.AddRegistrationSource(this);
    }

    public override object GetService(Type serviceType)
    {
        object result;
        if (_lifetimeScope.TryResolve(serviceType, out result))
        {
            return result;
        }

        return null;
    }

    public override IEnumerable<object> GetServices(Type serviceType)
    {
        object result;
        if (_lifetimeScope.TryResolve(typeof(IEnumerable<>).MakeGenericType(serviceType), out result))
        {
            return (IEnumerable<object>)result;
        }

        return Enumerable.Empty<object>();
    }

    public IEnumerable<IComponentRegistration> RegistrationsFor(Service service, Func<Service, IEnumerable<IComponentRegistration>> registrationAccessor)
    {
        var typedService = service as TypedService;
        if (typedService != null)
        {
            var instances = base.GetServices(typedService.ServiceType);

            if (instances != null)
            {
                return instances
                        .Select(i => RegistrationBuilder.ForDelegate(i.GetType(), (c, p) => i).As(typedService.ServiceType)
                        .InstancePerMatchingLifetimeScope(_lifetimeScope.Tag)
                        .PreserveExistingDefaults()
                        .CreateRegistration());
            }
        }

        return Enumerable.Empty<IComponentRegistration>();
    }

    bool IRegistrationSource.IsAdapterForIndividualComponents
    {
        get { return false; }
    }
}

}
```

Tested 1.0.0 and 1.0.1, they both break, only rc2 works.

[davidfowl]

@vladkosarev 403 sounds like a different issue to the protected data issue. There were fundamental changes made in 1.0.0 to fix security holes in previous versions (rc2, alpha etc). If you're getting a 500 that claims you have the wrong connection id format it's because you're making requests 2 signalr under different identities.

403 normally happens when you're making a cross origin request (or what we think is a cross origin request) and that looks like what you might be running into and I'm guess it's because of your url rewrite rules but I'm not 100% sure.

The logic that is likely causing your 403 is here
https://github.com/SignalR/SignalR/blob/master/src/Microsoft.AspNet.SignalR.Owin/Handlers/CallHandler.cs#L95

[vladkosarev]

@davidfowl I tried with EnableCrossDomain=true and had the same issue. By the way with 1.0.0/1.0.1 that issue was in Chrome but not in FF/IE9, maybe there's a Chrome bug of some sort. I forgot to mention that before.

The 500 error was System.Security.Cryptography.ProtectedData.Protect() stuff. I'll stick to rc2 for now and maybe next week try Chrome with 1.0.1 again.

[davidfowl]

The 500 errors means you have an issue in your code (specifically the one stated above). I can't think of any other reason the 403 would happen but I'm better it's the cross domain thing. If you can provide a repro application it would be great.

[ghost]

I have exatly same error, only on Azure WebSites, but works fins on debug, same client :

Server Error in '/' Application.
The data protection operation was unsuccessful. This may have been caused by not having the user profile loaded for the current thread's user context, which may be the case when the thread is impersonating.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Security.Cryptography.CryptographicException: The data protection operation was unsuccessful. This may have been caused by not having the user profile loaded for the current thread's user context, which may be the case when the thread is impersonating.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[CryptographicException: The data protection operation was unsuccessful. This may have been caused by not having the user profile loaded for the current thread's user context, which may be the case when the thread is impersonating.]
Microsoft.Owin.Host.SystemWeb.<>c__DisplayClass1.b__0(Exception ex) +27
Microsoft.Owin.Host.SystemWeb.Utils.RethrowWithOriginalStack(Exception ex) +15
Microsoft.Owin.Host.SystemWeb.CallContextAsyncResult.End(IAsyncResult result) +47
Microsoft.Owin.Host.SystemWeb.OwinHttpHandler.EndProcessRequest(IAsyncResult result) +7
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +9629708
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +155

Any idea ?

[davidfowl]

Can you send the link to your website? Is the code public?

[pszmyd]

Should it be reopened? This same issue is still appearing with 1.1.0beta under IIS >= 7.5, when running app pool under identity different than ApplicationPoolIdentity.

[jbarker4682]

I'm running into a similar issue:

[CryptographicException: Error occurred during a cryptographic operation. 8ff60d8e-9d8d-4a0d-bc5e-9c7e68122ddb]
System.Web.Security.Cryptography.HomogenizingCryptoServiceWrapper.HomogenizeErrors(Func2 func, Byte[] input) +115 System.Web.Security.Cryptography.HomogenizingCryptoServiceWrapper.Protect(Byte[] clearData) +59 System.Web.Security.MachineKey.Protect(ICryptoServiceProvider cryptoServiceProvider, Byte[] userData, String[] purposes) +62 System.Web.Security.MachineKey.Protect(Byte[] userData, String[] purposes) +122 Microsoft.AspNet.SignalR.SystemWeb.Infrastructure.MachineKeyProtectedData.Protect(String data, String purpose) +77 Microsoft.AspNet.SignalR.PersistentConnection.ProcessNegotiationRequest(HostContext context) +164 Microsoft.AspNet.SignalR.PersistentConnection.ProcessRequest(HostContext context) +87 Microsoft.AspNet.SignalR.Hubs.HubDispatcher.ProcessRequest(HostContext context) +199 Microsoft.AspNet.SignalR.Owin.CallHandler.Invoke(IDictionary2 environment) +835
Microsoft.AspNet.SignalR.Owin.Handlers.HubDispatcherHandler.Invoke(IDictionary`2 environment) +127
Microsoft.Owin.Host.SystemWeb.OwinCallContext.Execute() +117
Microsoft.Owin.Host.SystemWeb.OwinHttpHandler.BeginProcessRequest(HttpContextBase httpContext, AsyncCallback callback, Object extraData) +253
Microsoft.Owin.Host.SystemWeb.CallContextAsyncResult.End(IAsyncResult result) +64
Microsoft.Owin.Host.SystemWeb.OwinHttpHandler.EndProcessRequest(IAsyncResult result) +7
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +9628700
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

This is an ASP .NET web application running on VMWare with Windows Server 2008 R2 SP 1 under IIS 7.5.
Targets .Net 4.5 and ASP .Net 4.0 versions and has a mix of MVC & legacy .aspx.

The error occurs in the call to http://localhost/dss/signalr/negotiate?_=1376408974807
It returns a 500 Internal Server Error with the above referenced call-stack.

I have tried elevating the IIS app pool identities to admin and performing an IIS Reset, but this did not appear to change anything.

Everything else else seems to be working correctly.

Finally, I don't think this has any bearing, but I am using SignalR w/ RequireJS.

Here is my relevant code:

//Notifier.cs
//===========
public class Notifier : Hub
{
    public void SendGlobalMessage(string message)
    {
        Clients.All.addMessage(message);
    }
    public void SendLocalMessage(string message)
    {
        Clients.Caller.addMessage(message);
    }
    //other code omitted for brevity... (includes overrides for various OnXxx methods)
}

//Global.asax.cs
//==============
protected void Application_Start(Object sender, EventArgs ea)
{
    var hubConfiguration = new HubConfiguration { EnableDetailedErrors = true };
    RouteTable.Routes.MapHubs(hubConfiguration);
    //other code omitted...
}

//_Layout.cshtml
//===========
//other code omitted...

<script type="text/javascript">
    //signalr-hubs is mapped and shimmed with its dependency on signalr in the RequireJS config.

    require(['signalr-hubs'], function()
    {
         $(function()
         {
             var notifier = $.connection.notifier;
             notifier.addMessage = function(message)
             {
                 console.log(message);
             }

            $.connection.hub.start({ waitForPageLoad: false }).done(function()
            {
                 notifier.server.sendGlobalMessage("Hello Universe!!!");
                 notifier.server.sendLocalMessage("Hello to myself!");
            });
        });
    }
</script>

[NichUK]

Joshua,

I believe that I solved my issue by re-writing my hub.

I think that I was keeping the hub around artificially, rather than letting SignalR create and destroy them at its own will.

In fact… I went as far as to put a notice in the top of it:

/// <summary>
/// BEWARE!!! A Hub is NOT A PERSISTENT OBJECT! SignalR creates and releases them abitrarily!!!
/// Do not put anything in them, like observing observables...!
/// Interface to the outside world ONLY!
/// </summary>

I suspect that you will find you are doing something similar. Rewrite your hub to be as lightweight as possible, with nothing that you need to keep, so SignalR can do its stuff.

Nich

From: Joshua Barker [mailto:[email protected]]
Sent: 13 August 2013 17:57
To: SignalR/SignalR
Cc: Nich Overend
Subject: Re: [SignalR] Problem with SignalR and ASP.NET impersonation (#1591)

I'm running into a similar issue:

[CryptographicException: Error occurred during a cryptographic operation. 8ff60d8e-9d8d-4a0d-bc5e-9c7e68122ddb]
System.Web.Security.Cryptography.HomogenizingCryptoServiceWrapper.HomogenizeErrors(Func2 func, Byte[] input) +115
System.Web.Security.Cryptography.HomogenizingCryptoServiceWrapper.Protect(Byte[] clearData) +59
System.Web.Security.MachineKey.Protect(ICryptoServiceProvider cryptoServiceProvider, Byte[] userData, String[] purposes) +62
System.Web.Security.MachineKey.Protect(Byte[] userData, String[] purposes) +122
Microsoft.AspNet.SignalR.SystemWeb.Infrastructure.MachineKeyProtectedData.Protect(String data, String purpose) +77
Microsoft.AspNet.SignalR.PersistentConnection.ProcessNegotiationRequest(HostContext context) +164
Microsoft.AspNet.SignalR.PersistentConnection.ProcessRequest(HostContext context) +87
Microsoft.AspNet.SignalR.Hubs.HubDispatcher.ProcessRequest(HostContext context) +199
Microsoft.AspNet.SignalR.Owin.CallHandler.Invoke(IDictionary2 environment) +835
Microsoft.AspNet.SignalR.Owin.Handlers.HubDispatcherHandler.Invoke(IDictionary`2 environment) +127
Microsoft.Owin.Host.SystemWeb.OwinCallContext.Execute() +117
Microsoft.Owin.Host.SystemWeb.OwinHttpHandler.BeginProcessRequest(HttpContextBase httpContext, AsyncCallback callback, Object extraData) +253
Microsoft.Owin.Host.SystemWeb.CallContextAsyncResult.End(IAsyncResult result) +64
Microsoft.Owin.Host.SystemWeb.OwinHttpHandler.EndProcessRequest(IAsyncResult result) +7
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +9628700
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

This is an ASP .NET web application running on VMWare with Windows Server 2008 R2 SP 1 under IIS 7.5.
Targets .Net 4.5 and ASP .Net 4.0 versions and has a mix of MVC & legacy .aspx.

The error occurs in the call to http://localhost/dss/signalr/negotiate?_=1376408974807
It returns a 500 Internal Server Error with the above referenced call-stack.

I have tried elevating the IIS app pool identities to admin and performing an IIS Reset, but this did not appear to change anything.

Everything else else seems to be working correctly.

Finally, I don't think this has any bearing, but I am using SignalR w/ RequireJS.

Here is my relevant code:

//Notifier.cs
//===========
namespace Dss.Api.SignalR
{
public class Notifier : Hub
{
public void SendGlobalMessage(string message)
{
Clients.All.addMessage(message);
}

public void SendLocalMessage(string message)

{

Clients.Caller.addMessage(message);

}

//other code omitted for brevity... (includes overrides for various OnXxx methods)

}

}

//Global.asax.cs
//==============
protected void Application_Start(Object sender, EventArgs ea)
{
var hubConfiguration = new HubConfiguration { EnableDetailedErrors = true };
RouteTable.Routes.MapHubs(hubConfiguration);

//other code omitted...

}

_Layout.cshtml

//other code omitted...

—
Reply to this email directly or view it on GitHubhttps://github.com/SignalR/SignalR/issues/1591#issuecomment-22580041.

[jbarker4682]

Hi NichUK.... I removed everything from my Hub class except the two methods listed above (SendGlobalMessage & SendLocalMessage) and still got the error.

This has something to do with the SignalR MachineKeyProtectedData class and the .Net MachineKey.Protect() method (and probably either the MachineKeys system folder or the machine.config file), but I am not a security expert, so this is beyond me...

[davidfowl]

@jbarker4682 do you have a webfarm (multiple webservers)?

[jbarker4682]

@davidfowl no, this is running locally on my dev box...

[davidfowl]

Does it only happen when you recycle the application?

[resnyanskiy]

Had the same problem.
In a few words, ProtectedData.Protect method depends on 'account environment' which used by AppPool. So, if you enable user profile load, problem will solved.
FYI - What exactly happens when I set LoadUserProfile of IIS pool