How to share a data protection key among tenants?

[hieucd04]

I have 2 Orchard Core tenants:

• Tenant A: the default tenant under domain name www.localhost.com
• Tenant B: a tenant which exposes an API under domain name api.localhost.com

At tenant A, I issues a cookie with domain field set to .localhost.com.
Now, at tenant B, I want to reuse the above cookie to authenticate my API (Single Sign-On).
The problem is: I can't decrypt that cookie because each tenant has its own data protection key.

And to make the problem worst, I looked into Orchard Core source code and found this:

OrchardCore/src/OrchardCore/OrchardCore/Modules/Extensions/ServiceCollectionExtensions.cs

Lines 434 to 437 in 4093d2e

	// Re-register the data protection services to be tenant-aware so that modules that internally
	// rely on IDataProtector/IDataProtectionProvider automatically get an isolated instance that
	// manages its own key ring and doesn't allow decrypting payloads encrypted by another tenant.
	// By default, the key ring is stored in the tenant directory of the configured App_Data path.

Does it mean there are no hope left for me?

[Skrypt]

Use OpenId module for single sign on.

[ns8482e]

True

@hieucd04 the approach you are taking is opposite of idea of tenant isolation

if you need tenant isolation then you need to use open id as @Skrypt suggest

if you don’t need tenant isolation but need to use more than one domain that shares data then use single tenant and provide host names

[hieucd04]

I totally forgot that OpenId supports this.
Thank you! 😄

[jtkech]

Or use a shared data protection, for example our OC.Redis.DataProtection feature (needs a running Redis instance).

[ns8482e]

@jtkech having shared keyring between tenants will also not help here, as encryption is based on tenant name :)
And you can’t have duplicate tenants

may need deployment on two different nodes with same tenant name

[jtkech]

as encryption is based on tenant name :)

Are you sure? ;)

[ns8482e]

OrchardCore/src/OrchardCore/OrchardCore/Modules/Extensions/ServiceCollectionExtensions.cs

Line 441 in 4093d2e

.SetApplicationName(settings.Name)

[jtkech]

Oops yes, didn't remember that it allows to share data protection across OC instances but for the same tenant ;)

[hieucd04]

(needs a running Redis instance)

While this post directly answers my question it is unfortunately not viable in my case because of this.