security - 使用 OWIN/Katana 在 Azure 上进行数据保护操作失败

Question

我正在尝试在 Azure 中运行的基于 OWIN/Katana 的 ASP.NET MVC 网站上实现密码重置。

它在本地运行时工作正常，但在生产中失败。

我创建一个 UserToken 提供程序

userManager.UserTokenProvider = new DataProtectorTokenProvider<ApplicationUser>(provider.Create("PasswordReset"))

但是当我尝试按如下方式生成 token 时

var resetToken = await UserManager.GeneratePasswordResetTokenAsync(user.Id);

我收到以下异常。

System.Security.Cryptography.CryptographicException: The data protection operation was unsuccessful. This may have been caused by not having the user profile loaded for the current thread's user context, which may be the case when the thread is impersonating. at System.Security.Cryptography.ProtectedData.Protect(Byte[] userData, Byte[] optionalEntropy, DataProtectionScope scope) at System.Security.Cryptography.DpapiDataProtector.ProviderProtect(Byte[] userData) at System.Security.Cryptography.DataProtector.Protect(Byte[] userData) at Microsoft.Owin.Security.DataProtection.DpapiDataProtector.Protect(Byte[] userData) at Microsoft.AspNet.Identity.Owin.DataProtectorTokenProvider 2.d__0.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.AspNet.Identity.UserManager`2.d__e9.MoveNext()

Answer 1

如果主机服务器是虚拟机，则可能正是错误消息所述的内容。检查 IIS 中的应用程序池是否确实将 Load User Profile 设置为 true，如异常所示:

• 在“连接” Pane 中，展开服务器名称，然后单击“应用程序池”。
• 右键单击您的池
• 高级设置