tillig / dataprotection Goto Github PK

Travis, I wanted to thank you for posting this almost two years ago. I can't believe MS is ok with the problem this addresses -- or that the docs don't at least explain that the cert-object and PFX overrides for ProtectKeysWithCertificate are effectively useless. Only about a month ago they blew off somebody's request for help with vague handwaving about "framework limitations" -- and yet here we are with a simple, working example... from two years ago. Anyway, enough ranting.

I don't have time to convert to VS2017 and do a PR, but I thought I'd post the changes needed to integrate with ASP.NET Core 2.0. They changed how the encryptor is registered, apparently. (Also, for anyone wanting to target netcore instead of netframework, change the four references to RSACryptoServiceProvider in the encryptor and decryptor classes to just RSA -- everything else works after that.)

public static IDataProtectionBuilder ProtectKeysWithProvidedCertificate(this IDataProtectionBuilder builder, X509Certificate2 certificate)
{
    if(certificate == null)
    {
        throw new ArgumentNullException(nameof(certificate));
    }

    // save the certificate to DI
    builder.Services.AddSingleton(new CertificateEncryptionOptions(certificate));

    // set up the encryptor (encrypted nodes reference the decryptor by typename)
    builder.Services.AddSingleton<IConfigureOptions<KeyManagementOptions>>(provider =>
    {
        return new ConfigureOptions<KeyManagementOptions>(opts =>
        {
            opts.XmlEncryptor = ActivatorUtilities.CreateInstance<CertificateXmlEncryptor>(provider);
        });
    });

    return builder;
}

Quick note for you, I mentioned the cert decryption problem in a different DPAPI thread and MS says it's fixed in 2.1.0.

aspnet/DataProtection#299