How to share session cookie with Identity Server ASP.NET app and OWIN?

Question

I am using Identity Server v2 along with SessionAuthenticationModule.

I would like to add a new OWIN app (hosted in IIS) which can share the same session cookie "idsrvauth" with my existing STS.

How do I do this please?

1. Can the SessionAuthenticationModule decrypt the session cookie and set the IPrincipal in the OWIN app?
2. Or should I use OWIN middleware to do this? Is there existing middleware or will I need to write new?

I have the same machineKey in each web.config but when accessing the OWIN site, I get a CryptographicException:

CryptographicException: Error occurred during a cryptographic operation.
 System.Web.Security.Cryptography.HomogenizingCryptoServiceWrapper.HomogenizeErrors(Func`2 func, Byte[] input) +246
 System.IdentityModel.Services.MachineKeyTransform.Decode(Byte[] encoded) +200
 System.IdentityModel.Tokens.SessionSecurityTokenHandler.ApplyTransforms(Byte[] cookie, Boolean outbound) +173
 System.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(XmlReader reader, SecurityTokenResolver tokenResolver) +752
 System.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(Byte[] token, SecurityTokenResolver tokenResolver) +99
 System.IdentityModel.Services.SessionAuthenticationModule.ReadSessionTokenFromCookie(Byte[] sessionCookie) +1233
 System.IdentityModel.Services.SessionAuthenticationModule.TryReadSessionTokenFromCookie(SessionSecurityToken& sessionToken) +314
 System.IdentityModel.Services.SessionAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs eventArgs) +243
 System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +80
 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +165

Answer 1

I had similar issue and in my case it was missing validation="SHA1" in <machineKey ... > element.

According to MSDN it is a default one, but only after adding that explicitly my machine-key-based cryptography started working across 2 sites.