How to fix cryptography exception while request shared among multiple servers by load balancer on session time out

Solution: - Please follows the following steps:-

Step1:- Change the namespace throughout the application to “using System.IdentityModel;”

Step2:- Add the following code on Application_Start () section in global.asax

var sam = new SessionAuthenticationModule(); sam.SessionSecurityTokenReceived += sam_SessionSecurityTokenReceived; FederatedAuthentication.FederationConfigurationCreated += FederatedAuthentication_FederationConfigurationCreated;

And generate the following events

void FederatedAuthentication_FederationConfigurationCreated(object sender, System.IdentityModel.Services.Configuration.FederationConfigurationCreatedEventArgs e) { var sessionTransforms = new List(new CookieTransform[] { new DeflateCookieTransform(), new RsaEncryptionCookieTransform( e.FederationConfiguration.ServiceCertificate), new RsaSignatureCookieTransform( e.FederationConfiguration.ServiceCertificate) }); var sessionHandler = new SessionSecurityTokenHandler(sessionTransforms.AsReadOnly()); e.FederationConfiguration.IdentityConfiguration.SecurityTokenHandlers.AddOrReplace(sessionHandler); }

void sam_SessionSecurityTokenReceived(object sender, SessionSecurityTokenReceivedEventArgs e) { var _sam = sender as SessionAuthenticationModule; var sessionToken = e.SessionToken; DateTime now = DateTime.UtcNow; if (sessionToken.ValidTo > DateTime.UtcNow.AddMinutes(30)) { var slidingExpiration = sessionToken.ValidTo - now; e.SessionToken = _sam.CreateSessionSecurityToken( sessionToken.ClaimsPrincipal, sessionToken.Context, now, now + slidingExpiration, false ); e.ReissueCookie = true; } else { var sessionAuthenticationModule = (SessionAuthenticationModule)sender; sessionAuthenticationModule.DeleteSessionTokenCookie(); sessionAuthenticationModule.SignOut(); e.Cancel = true; } }

STEP3:- Add following section under in the web.config file. For localhost use this:

On the server, please replace localhost with “certificate name”

STEP4:- Make sure to use the same certificate in all the four servers. Following should be same in all the WFEs:

 Cert Name
 Thumbprint