I am running into this problem relating to the DataProtectionProvider, first we only had 2 .NET Framework projects, now a .NET Core project is added which confuses me how to do the following: Generate a password reset link from a .NET Framework project, and use it in the .NET Core project. Both use the same database and user table, which have been made compatible with each other. .NET Framework is still the leading project in Code-First database generation.
In both .NET Frameworks projects, I use one shared code bases, which has the following code:
//not sure where I got this from but it is part of the solution for solving
//password link generating and using in two different applications.
public class MachineKeyProtectionProvider : IDataProtectionProvider
{
public IDataProtector Create(params string[] purposes)
{
return new MachineKeyDataProtector(purposes);
}
}
public class MachineKeyDataProtector : IDataProtector
{
private readonly string[] _purposes;
public MachineKeyDataProtector(string[] purposes)
{
_purposes = purposes;
}
public byte[] Protect(byte[] userData)
{
return MachineKey.Protect(userData, _purposes);
}
public byte[] Unprotect(byte[] protectedData)
{
return MachineKey.Unprotect(protectedData, _purposes);
}
}
Then inside the User Repository:
private readonly UserManager<ApplicationUser> _userManager = null;
private readonly RoleManager<IdentityRole> _roleManager = null;
internal static IDataProtectionProvider DataProtectionProvider { get; private set; }
public UserRepository(DatabaseContext dbContext)
{
_userManager = new UserManager<ApplicationUser>(new UserStore<ApplicationUser>(dbContext));
_roleManager = new RoleManager<IdentityRole>(new RoleStore<IdentityRole>(dbContext));
_userManager.UserValidator = new UserValidator<ApplicationUser>(_userManager) { AllowOnlyAlphanumericUserNames = false };
if (DataProtectionProvider == null)
{
DataProtectionProvider = new MachineKeyProtectionProvider();
}
_userManager.UserTokenProvider = new DataProtectorTokenProvider<ApplicationUser, string>(DataProtectionProvider.Create("Identity"));
}
In both .NET Framework projects I have a <machineKey>
set. After that I can use simply:
public string GeneratePasswordResetCode(string userId)
{
return _userManager.GeneratePasswordResetToken(userId);
}
public void ChangeUserPassword(string oldPassword, string newPassword)
{
string id = InfrastructureUserHelper.User.GetUserId();
IdentityResult result = _userManager.ChangePassword(id, oldPassword, newPassword);
...
}
So, now a .NET Core project is added, which already has its own password reset mechanism working, but all the automated jobs are sent from one of the .NET Framework projects. Reason being that a user should set a password for an automatically created account.
How do I do this?
I have been looking at this:
https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview?tabs=aspnetcore2x
and this: How to implement machineKey in ASP.NET Core 2.0
But I cannot really figure out what a simple and easy solution is. I prefer to avoid creating an additional redis server. Something similar to machine key would do the job.
I tried starting with this documentation but I could not really figure out what part goes in the .NET Core project and what part goes into the .NET Framework project.
I have tried playing around with this part without luck so far:
public void ConfigureServices(IServiceCollection services)
{
services.AddDataProtection().SetApplicationName("Identity")
.SetDefaultKeyLifetime(TimeSpan.FromDays(60))
.ProtectKeysWithDpapi();
services.AddIdentity<ApplicationUser, ApplicationRole>().AddDefaultTokenProviders();
}
EDIT:
I eventually could use our Blob Storage for this, seeing this page:
https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview?tabs=aspnetcore2x
Adding this does seem to help a bit, both apps run fine but still in the .NET Framework project does not use the correct DataProtectionProvider. The UserManager cannot find it (No ITokenProvider error).
Eventually I kind of gave up and stored the token in the user database totally not ideal but to much time spent trying to solve something what is to much undocumented. -1 for Microsoft.
See Question&Answers more detail:
os