I can access my azure table storage (eotg) successfully when I call it from my local machine. When I publish to eyeonthegroundwebapp20250325083010 I get a 500 response. How do I modify the settings for eotg to allow access from the webapp.

Question

I can access my azure table storage (eotg) successfully when I call it from my local machine. When I publish to eyeonthegroundwebapp20250325083010 I get a 500 response. How do I modify the settings for eotg to allow access from the webapp.

Paul Sachs 20

I can access my azure table storage (eotg) successfully when I call it from my local machine. When I publish my webapp to my azure web app (eyeonthegroundwebapp20250325083010) I get a 500 response. How do I modify the settings for eotg to allow access from the webapp.

Paul Sachs 20 Reputation points

2025-04-08T13:37:18.75+00:00

I have checked the Firewall setting for the Azure Table Storage account, and it is set to "Enabled from all networks". I am getting the following error when I try to access the table storage account from the web app: "CryptographicException: The key {d15f72c7-194b-4c98-8773-00f068973be6} was not found in the key ring." The key shown is not the connection string or key for the storage account and I see no sign of that string in the code base.

I am using Microsoft.AspNetCore.Identity with AspNetCore.Identity.Stores.AzureStorageAccount.Extensions

I am setting the connection string as per this article: https://www.nuget.org/packages/AspNetCore.Identity.Stores.AzureStorageAccount

Not quite sure where to go next ...
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Paul Sachs 20 Reputation points

2025-04-08T13:38:54.2533333+00:00

I have checked the Firewall setting for the Azure Table Storage account, and it is set to "Enabled from all networks".

I am getting the following error when I try to access the table storage account from the web app: "CryptographicException: The key {d15f72c7-194b-4c98-8773-00f068973be6} was not found in the key ring." The key shown is not the connection string or key for the storage account and I see no sign of that string in the code base.

I am using Microsoft.AspNetCore.Identity with AspNetCore.Identity.Stores.AzureStorageAccount.Extensions I am setting the connection string as per this article: https://www.nuget.org/packages/AspNetCore.Identity.Stores.AzureStorageAccount

Not quite sure where to go next ...
Sirra Sneha 385 Reputation points Microsoft External Staff

2025-04-09T06:45:49.04+00:00

Hi @Paul Sachs ,
Can you please share your GitHub repo that have worked locally earlier.

Accepted answer

3 additional answers

Your answer

Paul Sachs 20 Reputation points

2025-04-08T13:37:18.75+00:00

I have checked the Firewall setting for the Azure Table Storage account, and it is set to "Enabled from all networks". I am getting the following error when I try to access the table storage account from the web app: "CryptographicException: The key {d15f72c7-194b-4c98-8773-00f068973be6} was not found in the key ring." The key shown is not the connection string or key for the storage account and I see no sign of that string in the code base.

I am using Microsoft.AspNetCore.Identity with AspNetCore.Identity.Stores.AzureStorageAccount.Extensions

I am setting the connection string as per this article: https://www.nuget.org/packages/AspNetCore.Identity.Stores.AzureStorageAccount

Not quite sure where to go next ...
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Paul Sachs 20 Reputation points

2025-04-08T13:38:54.2533333+00:00

I have checked the Firewall setting for the Azure Table Storage account, and it is set to "Enabled from all networks".

I am getting the following error when I try to access the table storage account from the web app: "CryptographicException: The key {d15f72c7-194b-4c98-8773-00f068973be6} was not found in the key ring." The key shown is not the connection string or key for the storage account and I see no sign of that string in the code base.

I am using Microsoft.AspNetCore.Identity with AspNetCore.Identity.Stores.AzureStorageAccount.Extensions I am setting the connection string as per this article: https://www.nuget.org/packages/AspNetCore.Identity.Stores.AzureStorageAccount

Not quite sure where to go next ...
Sirra Sneha 385 Reputation points Microsoft External Staff

2025-04-09T06:45:49.04+00:00

Hi @Paul Sachs ,
Can you please share your GitHub repo that have worked locally earlier.

Answer 1

Hi @Paul Sachs ,

I’m glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I’ll repost your solution in case you’d like to accept the answer.

The solution was to use blob storage to store the cryptographic key and then to delete previously created identities and start with fresh identities using the new cryptographic key. That works.

If the answer is helpful, please click Accept Answer and kindly upvote it so that other people who faces similar issue may get benefitted from it.

Answer 2

Hi Paul Sachs

Thanks for using the Q&A platform.

Kindly check if your Azure table storage has network restrictions enabled: Configure Azure Storage firewalls and virtual networks | Microsoft Learn.

Also, check that the connection string (DefaultEndpointsProtocol=...) for accessing table storage is set correctly.

Find Environment Variables and App Settings Reference - Azure App Service | Microsoft Learn Configure an App Service App - Azure App Service | Microsoft Learn

If the response was helpful, please feel free to mark it as “Accepted Answer” and consider giving it an upvote. This helps others in the community as well.

Regards,

Obinna

Answer 3

Obinna Ejidike 740

The error "CryptographicException: The key {GUID} was not found in the key ring" suggests the Data Protection system is trying to decrypt something using a key that isn't available on the current instance.

By default, ASP.NET Core uses the local file system for key storage, which doesn't work across multiple instances or across deployments in a web app unless you persist them centrally.

You should configure a central storage (like Azure Blob Storage) for Data Protection keys.

Find https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/implementation/key-storage-providers?view=aspnetcore-7.0&tabs=visual-studio

Ensure your Web App has access to that blob container via a connection string or Managed Identity: https://learn.microsoft.com/en-us/azure/app-service/scenario-secure-app-access-storage?tabs=azure-portal

If the response was helpful, please feel free to mark it as “Accepted Answer” and consider giving it an upvote. This helps others in the community as well.

Regards,

Obinna

Paul Sachs 20 Reputation points

2025-04-08T14:55:49.3733333+00:00

Thanks, I will try that and let you know, looks like the right answer, thanks.
Paul Sachs 20 Reputation points

2025-04-08T15:14:12.8266667+00:00
I have added the following code to Program.cs, which runs fine:

string containerName = "eotg-key-container"; string blobName = "keys.xml"; var container = new BlobContainerClient(connectionString, containerName); container.CreateIfNotExists(); var blobClient = container.GetBlobClient(blobName); builder.Services.AddDataProtection().PersistKeysToAzureBlobStorage(blobClient);

But now I get the "CryptographicException: The key {d15f72c7-194b-4c98-8773-00f068973be6} was not found in the key ring" error when I run the web app locally on my PC, and also on the webapp.

The key has been stored in the blob as expected.

Paul Sachs 20

Hi, this is the code that I run. It runs locally without error. When I uncomment thre code block, it produces the error when I attempt a login on the webapp.

using EOTG.Data;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using AspNetCore.Identity.Stores;
using AspNetCore.Identity.Stores.AzureStorageAccount.Extensions;
using Microsoft.AspNetCore.DataProtection;
using Azure.Storage.Blobs;

var builder = WebApplication.CreateBuilder(args);
var connectionString = builder.Configuration.GetConnectionString("DefaultConnection");
builder.Services.Configure<IdentityStoresOptions>(options => options
    .UseAzureStorageAccount(connectionString));
builder.Services.AddDefaultIdentity<IdentityUser>(options => options.SignIn.RequireConfirmedAccount = true)
    .AddRoles<IdentityRole>()
    .AddAzureStorageAccountStores(); //Add Identity stores


// when this code section is uncommented I get the error locally
//string containerName = "eotg-key-container";
//string blobName = "keys.xml";
//var container = new BlobContainerClient(connectionString, containerName);
//container.CreateIfNotExists();
//var blobClient = container.GetBlobClient(blobName);
//builder.Services.AddDataProtection().PersistKeysToAzureBlobStorage(blobClient);


// Configure the HTTP request pipeline.
var app = builder.Build();
if (app.Environment.IsDevelopment())
{
    app.UseMigrationsEndPoint();
}
else
{
    app.UseExceptionHandler("/Home/Error");
    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
    app.UseHsts();
}
// =================================
app.UseDeveloperExceptionPage();
// =================================
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseAuthorization();
app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}");
app.MapRazorPages();
app.Run();

Paul Sachs 20 Reputation points

2025-04-09T11:16:54.4733333+00:00

Here is the github repo. It contains the table storage key, which I will change when we are finished. There is no sensitive data in the storage area.

https://github.com/paulsachs777/EOTG
Paul Sachs 20 Reputation points

2025-04-10T10:19:17.47+00:00

The solution was to use blob storage to store the cryptographic key and then to delete previously created identities and start with fresh identities using the new cryptographic key. That works.
TP 118.2K Reputation points

2025-04-10T13:48:44.95+00:00

@Paul Sachs Please click Accept Answer on Obinna's answer above. I will add additional notes to it and reorganize comments so it is easier for people in the future to follow progression of how you solved the issue.

Thank you.

Answer 4

Paul Sachs 20

Hi, this issue seems to have gone away. I am not sure why, but I am happy to close the issue. Thanks.

Sirra Sneha 385 Reputation points Microsoft External Staff

2025-04-10T08:03:04.45+00:00

Hi @Paul Sachs ,

I’m glad that you were able to resolve your issue, and can you please share more details about the solution if you have any.

Share via

I can access my azure table storage (eotg) successfully when I call it from my local machine. When I publish to eyeonthegroundwebapp20250325083010 I get a 500 response. How do I modify the settings for eotg to allow access from the webapp.

3 additional answers

Your answer