Troubleshooting: Failed to decrypt using provider 'RsaProtectedConfigurationProvider'

Version Affected: All
 
 

Overview

Users see an error referencing "Failed to decrypt using provider 'RsaProtectedConfigurationProvider'" when browsing to a realm, or when a web.config file fails to decrypt on an IdP node. Depending on whether custom errors are enabled, this can appear as a generic browser message or as a detailed IIS configuration error:

This error has two independent causes:

• See Cause 1 - The calling identity does not have permission to open the machine key / RSA key container.
• See Cause 2 - The IdP nodes are running different .NET Framework versions, which use different encryption algorithms.

These causes are not related, so a fix for one cause will not resolve the other cause.

 

In this article

• Cause 1: Calling Identity Cannot Open the Key Container
• Cause 2: Mismatched .NET Framework Version Between IdP Nodes

Cause 1: Calling Identity Cannot Open the Key Container

This cause can occur when browsing to any realm on the appliance. The calling identity — the account actually making the request — does not have permission to open the machine key / RSA key container that RsaProtectedConfigurationProvider uses to decrypt the web.config. Depending on configuration, the calling identity could be the ApplicationPoolIdentity (IIS AppPool\SecureAuth0Pool), Network Service, and/or Authenticated Users (when Integrated Windows Authentication / WindowsSSO is in use).

To resolve this:

1. Open an Admin Command Prompt.
2. Run the following command(s) to grant the required access:
   C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Aspnet_regiis -pa "NetFrameworkConfigurationKey" "Network Service"
   C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Aspnet_regiis -pa "NetFrameworkConfigurationKey" "IIS AppPool\SecureAuth0pool"
   
   Only required if Integrated Windows Authentication is in use (WinSSO):
   C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Aspnet_regiis -pa "NetFrameworkConfigurationKey" "Authenticated Users"

Cause 2: Mismatched .NET Framework Version Between IdP Nodes

This cause occurs specifically when a web.config file encrypted on one IdP node fails to decrypt on another node. It is caused by a mismatch in the encryption algorithm between the servers, due to the servers running different .NET Framework versions. Older .NET Framework versions use TripleDES for encryption, while .NET Framework 4.8 and later use AES.

To resolve this:

1. Confirm the installed .NET Framework version on each IdP node — see Microsoft's guide to determining installed .NET Framework versions.
2. Make sure the .NET Framework version is the same on all IdP nodes.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.