Error "Failed to decrypt using provider 'DataProtectionConfigurationProvider'... The RSA key container could not be opened." when trying to use encrypted system.web/identity on web service

Question

Hi there,

I'm receiving the following error when trying to access a web service that is using (for temporary reasons) an encrypted system.web/identity entry:

Failed to decrypt using provider 'DataProtectionConfigurationProvider'. Error message from the provider: The RSA key container could not be opened.

I've followed the steps found in comments at http://blogs.msdn.com/mosharaf/archive/2005/11/17/protectedConfiguration.aspx, and these are the steps I've done:

1. Added "xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0"" to the configuration attribute in the web service's web.config
2. Create a container using aspnet_regiis -pc "DataProtectionConfigurationProviderKeys" -exp
3. Added the following to the web.config: <configProtectedData> <providers> <clear /> <add name="DataProtectionConfigurationProvider" type="System.Configuration.RsaProtectedConfigurationProvider, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a,processorArchitecture=MSIL" keyContainerName="DataProtectionConfigurationProviderKeys" useMachineContainer="true" /> </providers> </configProtectedData>
4. Granted access to the key container to the account IIS is running under: aspnet_regiis -pa "DataProtectionConfigurationProviderKeys" "eca\iusr_xxxxx". I also granted access to the impersonated account (e.g. the one in the identity attribute) using the same command.
5. I then encrypted the system.web/identity entry: aspnet_regiis -pef "system.web/identity" "C:\ddrive\EcaDevelopment\EcaApplicationsNet2\Projects\TASV2\Mainline\src\TASV2.WordToPdf.WebSvc" -prov "DataProtectionConfigurationProvider"

But, when I try to run my test harness against the web service, I get:

Failed to decrypt using provider 'DataProtectionConfigurationProvider'. Error message from the provider: The RSA key container could not be opened.

What have I missed out? Can I actually encrypt just the identity tag? I can encrypt and use the connectionStrings no problem...

Thanks for any help,

Mike Kningscott