title: DataProtection - Share machine key between multiple applications
body: <p>Let's suppose that we have two APIs, one for <code>UserManagement</code> and one for <code>Auth</code>. </p>
  
  <p><code>UserManagement API</code> is responsible for initial invitation email (where i need a <code>ResetPasswordToken</code> because this is my current app flow) and <code>Auth API</code> is responsible for password recovery (where i need a <code>ResetPasswordToken</code>).</p>
  
  <p>Of course, i need to specify the same machine key for both applications. </p>
  
  <p>Let's also suppose that those two applications will be deployed behind a load balancer. 2 apps x 3 instances.</p>
  
  <p>It is sufficient to have the same shared location for persisting keys (Redis or so) in both APIs?</p>
  
  <pre><code>services.AddDataProtection().PersistKeysToRedis(/* */);
  </code></pre>
  
  <p>I'm thinking that if it works for one app, multiple instances scenario, it will work for multiple apps, multiple instances scenario too.</p>
  
  <p>P.S: I wasn't able to find anything about any locking mechanism (it seems that there is one just looking at how it behaves) </p>
  
  <p>Another thing that i'm concerned of: race condition?!</p>
  
  <blockquote>
    <p>Duc_Thuan_Nguy Jun 9, 2017 </p>
    
    <p>Out of curiosity, how does key rolling
    handle concurrency? For example, let's say we have a web-farm with 2
    machines and a shared network directory. There may be a race condition
    in which both machines want to roll a new key at the same time. How is
    this situation handled? Or the two machines can roll their own new
    keys and as long as they can have access to both new keys, they can
    unprotect data smoothly?</p>
  </blockquote>
  
  <p>Comment reference: <a href="https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/implementation/key-management" rel="noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/implementation/key-management</a></p>
  
  <p><strong>Later edit:</strong> It looks like if you have multiple apps it isn't sufficient to specify that you want to persist keys in the same location. There is a concept of application discriminator (all apps being isolated). </p>
  
  <p>You will need something like the following: </p>
  
  <pre><code>services.AddDataProtection(configure =&gt; {
                  configure.ApplicationDiscriminator = "App.X";
              }).PersistKeysToRedis(/* */);
  </code></pre>
  
  <p>Locking and race condition questions are still valid. </p>