Modifying encrypted data in appsettings files

Question

I'm reading this documentation page about Modifying encrypted data. It says "To use the Access Management tool, you must be logged in as a properly authorized user." Further down, the described procedure says that you should either sign in as the user who originally ran the "start" script, or that you should sign in as the Windows Local System account.

Signing in as Local System doesn't strike me as practical. Is there an alternative technique available for use when running the services as Windows Services?

Having to log in as the user who ran the original installation is also less than ideal. With the configuration encryption in previous versions, we had similar issues, where the necessary key pair would be associated with a Windows account, but we were able to safeguard the key pairs by exporting them with aspnet_regiis. Is there a similar technique we might use in combination with dotnet AppSettingsProtector.dll protect? Does this differ between Windows and Linux?

Answer 1

AFAIK, It uses ASP.NET Core Data Protection API, Encrypting the data in the Access Management configuration file will generate the key XML in the service installed bin\Key folder.

Example: C:\AccessManagementService\bin\Key\key-xxxxx-4b83-43eb-89ce-79351f47532b.xml

As long as if you have this key XML, you should be able to decrypt the configuration file, nothing to do with the Local system users.

I did try the following it works.

I did copy the Key XML file and configuration appsettings.json file from server to local system in the access management service folder and then did run this "dotnet AppSettingsProtector.dll unprotect -f appsettings.json" It works as expected.

The benefits of using ASP.NET Core DataProtection APIs are:

• Replacement for the classic MachineKey
• No need to design an encryption algorithm on your own, just use the most secured framework provided algorithms.
• Without having to manage the key yourself, the framework will automatically store and manage the key for you.
• The key is refreshed every 90 days by default
• API is easy to use without requiring to know deep about encryptions

Answer to your question: Does this differ between Windows and Linux?

A: Indeed!, The documentation needs some correction, there is no start.sh script in the installation media for the Access Management, Access Management service developed using .NET Core, It's possible to run it as a docker container. I will inform this to documentation team to update.

I hope it helps.