CODEWITHSUNDEEP
asp.netencryptionwindows-serviceswindowsdomainaccountrsaprotectedconfiguration
kspence
kspence

Reputation: 442

Windows service can't open RSA key container

Some background:

I have a solution that consists of:

Both the IIS application and windows service are run under the same domain account. They also connect to the same database.

Database access credentials are stored in a common config file and are encrypted using the aspnet_regiis.exe tool. An ACL permission grants read access to the key container for the domain account.

The web application can access the key container and decrypt the connection string.

The service on the other hand can not access the RSA key container. I get the error:

Unexpected error attempting to connect to the database; exception: System.Configuration.ConfigurationErrorsException: Failed to decrypt using provider 'RsaProtectedConfigurationProvider'. Error message from the provider: The RSA key container could not be opened. (C:\ApplicationDir\ConnectionSettings.config line 2) ---> System.Configuration.ConfigurationErrorsException: The RSA key container could not be opened.

Workarounds:

  1. Add the domain account to the Administrators group (Yikes!)
  2. Add the domain account to the IIS_IUSRS group
  3. Change the permission entry on the Everyone group. By default, the read permission is applied to This folder only. Changing this value to This folder, subfolders and files seems to work.
  4. Add a permission entry for the domain account on the MachineKeys folder

I'm leaning towards option 2, but what the heck is going on here?

Why can the application pool run under said domain account work and not the windows service which is running under the same domain account?

Is this a situation where under certain circumstances the domain account is not considered part of the Everyone group?

What's the best practice for handling this situation?

Thanks, Kevin

Upvotes: 1

Views: 4857

Answers (1)

kspence
kspence

Reputation: 442

So it turns out that read access needs to be granted to the "NetFrameworkConfigurationKey" for the domain account. 

aspnet_regiis -pa "NetFrameworkConfigurationKey" "[DOMAIN_NAME]\[USER_ACCOUNT]"

More info: http://msdn.microsoft.com/en-us/library/yxw286t2(v=vs.100).aspx

Upvotes: 5

Related Questions