DataProtection and scaling /8 #33104

Rick-Anderson · 2024-07-16T22:47:16Z

@amcasey maybe I don't understand the topic, In your draft " However, when an app scales horizontally by adding more instances, it becomes necessary to explicitly configure Data Protection to establish a shared storage location for Data Protection keys. "

But not in all horizontal scaling (right). It's important to not assume much knowledge for newer users.

I think we can lower the friction if I use your draft to create the article.

Internal previews

📄 File	🔗 Preview link
aspnetcore/host-and-deploy/web-farm.md	aspnetcore/host-and-deploy/web-farm
aspnetcore/security/data-protection/configuration/default-settings.md	aspnetcore/security/data-protection/configuration/default-settings
aspnetcore/security/data-protection/configuration/scaling.md	aspnetcore/security/data-protection/configuration/scaling

amcasey · 2024-07-16T23:57:35Z

" However, when an app scales horizontally by adding more instances, it becomes necessary to explicitly configure Data Protection to establish a shared storage location for Data Protection keys. "

I think my statement was correct, but I agree that it could mislead new users and should be updated. It is true that someone has to decide and configure where that shared storage location will be, but that someone may not be the app author (e.g. in ACA or App Services on Windows).

amcasey

Thanks for driving this, @Rick-Anderson! I appreciate it.

aspnetcore/host-and-deploy/web-farm.md

aspnetcore/security/data-protection/configuration/scaling.md

aspnetcore/security/data-protection/configuration/scaling/includes/scaling7.md

aspnetcore/security/data-protection/configuration/scaling.md

amcasey · 2024-07-17T00:18:57Z

aspnetcore/security/data-protection/configuration/scaling.md

+author: acasey
+description: Learn how to configure Data Protection in ASP.NET Core for multi-instance apps.
+ms.author: acasey
+ms.custom: mvc


@Rick-Anderson Do you happen to know what this means/does? I just copied it from the overview.

Co-authored-by: Andrew Casey <[email protected]>

aspnetcore/security/data-protection/configuration/scaling.md

amcasey · 2024-07-17T16:25:26Z

aspnetcore/security/data-protection/configuration/scaling.md

+* Newly created Azure Container Apps built using ASP.NET Core Kestrel. For more information see [Autoscaling considerations
+](/azure/container-apps/dotnet-overview#autoscaling-considerations).
+
+The following distributed environments do ***NOT*** provide automatic key storage in a shared location:


I think I might characterize these as scenarios where keys will not be shared across instances (even if they have a shared location).

amcasey · 2024-07-17T16:25:58Z

aspnetcore/security/data-protection/configuration/scaling.md

+* Separate [deployment slots](/azure/app-service/deploy-staging-slots), such as Staging and Production.
+* Azure Container Apps built using ASP.NET Core Kestrel 7.0 or earlier. For more information see [Autoscaling considerations
+](/azure/container-apps/dotnet-overview#autoscaling-considerations).
+* Asp.net core apps hosted on multiple non-Azure VMs that don't use server affinity.


Server affinity doesn't get you shared storage, it makes shared storage unnecessary.

Out of curiosity, how are we going to keep this up-to-date if/when non-Azure clouds add support for this (which they can straightforwardly do, if they're interested)?

Out of curiosity, how are we going to keep this up-to-date if/when non-Azure clouds add support for this (which they can straightforwardly do, if they're interested)?

See #33108

Co-authored-by: Andrew Casey <[email protected]>

aspnetcore/host-and-deploy/web-farm.md

amcasey · 2024-07-18T21:07:29Z

aspnetcore/security/data-protection/configuration/scaling.md

+The following distributed environments provide automatic key storage in a shared location:
+
+* [Azure apps](/aspnet/core/security/data-protection/configuration/default-settings).  For more information see <xref:security/data-protection/configuration/default-settings#key-management>.
+* Newly created Azure Container Apps built using ASP.NET Core. For more information see [Autoscaling considerations


I've asked ACA for a date we can use in place of "newly created".

Did you get a date?

amcasey · 2024-07-18T21:07:58Z

aspnetcore/security/data-protection/configuration/scaling.md

+The following distributed environments provide automatic key storage in a shared location:
+
+* [Azure apps](/aspnet/core/security/data-protection/configuration/default-settings).  For more information see <xref:security/data-protection/configuration/default-settings#key-management>.
+* Newly created Azure Container Apps built using ASP.NET Core. For more information see [Autoscaling considerations


@claudiaregio Can you remember how we scoped this? I've suddenly remembered that this might only affect Aspire apps for now?

@claudiaregio Can you remember how we scoped this? I've suddenly remembered that this might only affect Aspire apps for now?

@claudiaregio ?

amcasey · 2024-07-18T21:11:05Z

aspnetcore/security/data-protection/configuration/scaling.md

+* Newly created Azure Container Apps built using ASP.NET Core. For more information see [Autoscaling considerations
+](/azure/container-apps/dotnet-overview#autoscaling-considerations).
+
+The following scenarios do ***NOT*** provide automatic key storage in a shared location:


This list still feels off to me. What if we framed it as a list of caveats and dropped the mention of non-Azure and ARR?

If ARR is important, we could say that it's an alternative (that applies everywhere, not just non-Azure) though, personally, I think we covered that adequately in the intro.

@amcasey Can you use the suggestion feature to rough draft your approach? I can wordsmith your suggestion

aspnetcore/security/data-protection/configuration/scaling.md

amcasey · 2024-10-04T21:26:45Z

aspnetcore/security/data-protection/configuration/scaling.md

+
+## Managing Data Protection keys outside the app
+
+An app with multiple instances may occasionally see an error like `System.Security.Cryptography.CryptographicException: The key {A6EF5BC2-FDCC-4C0C-A3A5-CDA9A1733D70} was not found in the key ring.`.  This can happen when instances get out of sync and data protected on one instance (e.g. an anti-forgery token) is unprotected on another instance (e.g. because a form was served from the former and posted to the latter) that doesn't yet know about that key.  When this happens, an app user may have to resubmit a form or re-authenticate (if it was an authentication token that couldn't be unprotected).


Wordsmith away.

amcasey · 2024-10-04T21:27:08Z

aspnetcore/security/data-protection/configuration/scaling.md

+
+For example, with Azure blob storage as the key repository, the key manager could be a simple console app run on a schedule.
+
+```csharp


I'm sure there's a more conventional way to include code samples. Let me know if you want a zip of the project.

I moved them.

amcasey · 2024-10-04T21:27:34Z

aspnetcore/security/data-protection/configuration/scaling.md

+
+Note that app instances will throw exceptions if they need to perform any `Protect` or `Unprotect` operations before the key manager has run for the first time, so it is preferable to execute it before creating app instances.
+
+:::moniker-end


I couldn't figure out a nice way to phrase "ACA will do this for you automatically, if you let it".

review my rewrite and use the suggestion feature if needed.

Co-authored-by: Andrew Casey <[email protected]>

aspnetcore/security/data-protection/configuration/scaling.md

aspnetcore/security/data-protection/configuration/scaling/includes/scaling7.md

aspnetcore/host-and-deploy/web-farm.md

Rick-Anderson · 2024-07-17T01:02:45Z

aspnetcore/security/data-protection/configuration/scaling.md

+The following distributed environments do ***NOT*** provide automatic key storage in a shared location:
+
+* Separate [deployment slots](/azure/app-service/deploy-staging-slots), such as Staging and Production.


@amcasey @adityamandaleeka, for customers on the .NET 8+, the list where it doesn't work is just deployment slots. Is that the only place it doesn't work with .NET 8+

Rick-Anderson · 2024-07-17T01:04:07Z

aspnetcore/security/data-protection/configuration/scaling.md

+The following distributed environments provide automatic key storage in a shared location:
+
+* [Azure apps](/aspnet/core/security/data-protection/configuration/default-settings).  For more information see <xref:security/data-protection/configuration/default-settings#key-management>.
+* Newly created Azure Container Apps built using ASP.NET Core Kestrel. For more information see [Autoscaling considerations


@amcasey What's newly created? Can we be more precise?

Rick-Anderson · 2024-12-05T22:06:49Z

aspnetcore/security/data-protection/configuration/scaling.md

+
+For example, with Azure blob storage as the key repository, the key manager could be a simple console app run on a schedule.
+
+```csharp


I moved them.

Rick-Anderson · 2024-12-05T22:11:18Z

aspnetcore/security/data-protection/configuration/scaling.md

+
+Note that app instances will throw exceptions if they need to perform any `Protect` or `Unprotect` operations before the key manager has run for the first time, so it is preferable to execute it before creating app instances.
+
+:::moniker-end


review my rewrite and use the suggestion feature if needed.

Rick-Anderson · 2024-12-06T01:03:03Z

aspnetcore/security/data-protection/configuration/scaling/samples/AzBlobKey/Program.cs

+
+var hostBuilder = new HostApplicationBuilder();
+
+// hostBuilder.Configuration.AddJsonFile("appsettings.json", optional: false, reloadOnChange: false);


@amcasey not needed so commented out. Will remove line or comment characters.

Rick-Anderson · 2024-12-06T01:50:37Z

aspnetcore/security/data-protection/configuration/scaling/samples/AzBlobKey/appsettings.json

+{
+  "AzureURIs": {
+    "BlobStorage": "https://<storage-account>.blob.core.windows.net/<container>/keys.xml",
+    "KeyVault": "https://<key-vault-name>.vault.azure.net/keys/<key-name>/"


Suggested change

"KeyVault": "https://<key-vault-name>.vault.azure.net/keys/<key-name>/"

"KeyVault": "https://<key-vault-name>.vault.azure.net/"

Pls review my suggested change from your version.

Rick-Anderson · 2024-12-06T01:51:39Z

aspnetcore/security/data-protection/configuration/scaling/samples/AzBlobKey/appsettings.json

+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Warning"
+    }
+  },
+  "AllowedHosts": "*"


I can remove this JSON but that's what the templates produce and in the article I yellow highlight the AKV URIs

Rick-Anderson added 4 commits July 16, 2024 12:46

DataProtection and scaling

f524f55

DataProtection and scaling

7e7f446

DataProtection and scaling

09a8106

DataProtection and scaling

ba71c7b

Rick-Anderson requested a review from amcasey July 16, 2024 23:53

amcasey reviewed Jul 17, 2024

View reviewed changes

amcasey requested a review from claudiaregio July 17, 2024 00:11

adityamandaleeka reviewed Jul 17, 2024

View reviewed changes

aspnetcore/security/data-protection/configuration/scaling.md Outdated Show resolved Hide resolved

amcasey reviewed Jul 17, 2024

View reviewed changes

Rick-Anderson and others added 8 commits July 16, 2024 14:34

Apply suggestions from code review

36f9423

Co-authored-by: Andrew Casey <[email protected]>

DataProtection and scaling

1973c82

DataProtection and scaling

73d70c1

react to feedback

907cfc6

react to feedback

6ea6eec

react to feedback

8c27b91

react to feedback

5dea93a

react to feedback

ba6186b

Rick-Anderson requested review from adityamandaleeka and amcasey July 17, 2024 01:26

amcasey reviewed Jul 17, 2024

View reviewed changes

Rick-Anderson and others added 3 commits July 17, 2024 08:45

Apply suggestions from code review

0d6f57d

Co-authored-by: Andrew Casey <[email protected]>

react to feedback

33d328c

react to feedback

fff74ab

Rick-Anderson mentioned this pull request Jul 17, 2024

Quarterly review: Which distributed environments DO/DON't provide automatic key storage in a shared location #33108

Open

2 tasks

amcasey mentioned this pull request Jul 18, 2024

[Epic] Improve the Data Protection experience for apps with multiple instances dotnet/aspnetcore#53654

Closed

amcasey reviewed Jul 18, 2024

View reviewed changes

aspnetcore/host-and-deploy/web-farm.md Outdated Show resolved Hide resolved

amcasey reviewed Jul 18, 2024

View reviewed changes

react to feedback

4963274

Rick-Anderson changed the title ~~DataProtection and scaling~~ DataProtection and scaling /8 Jul 23, 2024

Draft a section on how to use a separate key manager to eliminate races

065ba19

amcasey mentioned this pull request Oct 4, 2024

Define a pattern for a component that ensures a data protection keyring has an active key dotnet/aspnetcore#52916

Open

1 task

amcasey reviewed Oct 14, 2024

View reviewed changes

Rick-Anderson and others added 10 commits December 4, 2024 14:47

react to feedback

2201cd3

Update aspnetcore/host-and-deploy/web-farm.md

ec06d56

Co-authored-by: Andrew Casey <[email protected]>

react to feedback

e058df8

react to feedback

6a7ebb0

react to feedback

96a80b3

react to feedback

50e65a4

react to feedback

807f8f6

react to feedback

6e07927

react to feedback

8537b5f

react to feedback

5e53be9

Rick-Anderson commented Dec 6, 2024

View reviewed changes

Rick-Anderson requested review from amcasey and claudiaregio and removed request for claudiaregio December 6, 2024 01:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DataProtection and scaling /8 #33104

DataProtection and scaling /8 #33104

Rick-Anderson commented Jul 16, 2024 •

edited by github-actions bot

Loading

amcasey commented Jul 16, 2024

amcasey left a comment

amcasey Jul 17, 2024

amcasey Jul 17, 2024

amcasey Jul 17, 2024

amcasey Jul 17, 2024

Rick-Anderson Jul 17, 2024

amcasey Jul 18, 2024

Rick-Anderson Dec 5, 2024

amcasey Jul 18, 2024

Rick-Anderson Dec 5, 2024

amcasey Jul 18, 2024

Rick-Anderson Dec 5, 2024

amcasey Oct 4, 2024

amcasey Oct 4, 2024

Rick-Anderson Dec 5, 2024

amcasey Oct 4, 2024

Rick-Anderson Dec 5, 2024

Rick-Anderson Jul 17, 2024

Rick-Anderson Jul 17, 2024

Rick-Anderson Dec 5, 2024

Rick-Anderson Dec 5, 2024

Rick-Anderson Dec 6, 2024

Rick-Anderson Dec 6, 2024

Rick-Anderson Dec 6, 2024


		## Managing Data Protection keys outside the app

		An app with multiple instances may occasionally see an error like `System.Security.Cryptography.CryptographicException: The key {A6EF5BC2-FDCC-4C0C-A3A5-CDA9A1733D70} was not found in the key ring.`. This can happen when instances get out of sync and data protected on one instance (e.g. an anti-forgery token) is unprotected on another instance (e.g. because a form was served from the former and posted to the latter) that doesn't yet know about that key. When this happens, an app user may have to resubmit a form or re-authenticate (if it was an authentication token that couldn't be unprotected).


		For example, with Azure blob storage as the key repository, the key manager could be a simple console app run on a schedule.

		```csharp


		Note that app instances will throw exceptions if they need to perform any `Protect` or `Unprotect` operations before the key manager has run for the first time, so it is preferable to execute it before creating app instances.

		:::moniker-end

		The following distributed environments do *NOT* provide automatic key storage in a shared location:

		* Separate [deployment slots](/azure/app-service/deploy-staging-slots), such as Staging and Production.


		var hostBuilder = new HostApplicationBuilder();

		// hostBuilder.Configuration.AddJsonFile("appsettings.json", optional: false, reloadOnChange: false);

	"KeyVault": "https://<key-vault-name>.vault.azure.net/keys/<key-name>/"
	"KeyVault": "https://<key-vault-name>.vault.azure.net/"

DataProtection and scaling /8 #33104

Are you sure you want to change the base?

DataProtection and scaling /8 #33104

Conversation

Rick-Anderson commented Jul 16, 2024 • edited by github-actions bot Loading

Internal previews

amcasey commented Jul 16, 2024

amcasey left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Rick-Anderson commented Jul 16, 2024 •

edited by github-actions bot

Loading