locked
ASP.NET Identity throwing CryptographicException when decrypting ADFS cookie RRS feed

  • Question

  • User-1364044738 posted

    It appears that ASP.NET on occassions is having difficulty with the ADFS cookie.  We are seeing this probably once or twice a week from a group of 10 people using a website using ADFS.  It appears clearing the cache deletes the cookie, sending them back to ADFS for authentication and everything starts working well for the user.

    This is a problem we really need to figure out, before we deploy wider within the company.

    The exception we are seeing is:

    Exception information:

        Exception type: CryptographicException

        Exception message: Error occurred during a cryptographic operation.

       at System.Web.Security.Cryptography.HomogenizingCryptoServiceWrapper.HomogenizeErrors(Func`2 func, Byte[] input)

       at System.IdentityModel.Tokens.SessionSecurityTokenHandler.ApplyTransforms(Byte[] cookie, Boolean outbound)

       at System.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(XmlReader reader, SecurityTokenResolver tokenResolver)

       at System.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(Byte[] token, SecurityTokenResolver tokenResolver)

       at System.IdentityModel.Services.SessionAuthenticationModule.ReadSessionTokenFromCookie(Byte[] sessionCookie)

       at System.IdentityModel.Services.SessionAuthenticationModule.TryReadSessionTokenFromCookie(SessionSecurityToken& sessionToken)

       at System.IdentityModel.Services.SessionAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs eventArgs)

       at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()

       at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

    Any ideas?

    Wednesday, June 10, 2015 3:33 PM

Answers

  • User-166373564 posted

    Hi,

    For this issue, if you use form authentication, generally it's recommended to create a valid cookie.

    catch (CryptographicException cex)
    {
       
    FormsAuthentication.SignOut();
    }

    WIth regards,

    Angie

    • Marked as answer by Anonymous Thursday, October 7, 2021 12:00 AM
    Thursday, June 18, 2015 2:25 AM