title: Trying to use encrypted system.web/identity on web service errors with "Failed to decrypt using provider"
body: <p>I'm receiving the following error when trying to access a web service that is using (for temporary reasons) an encrypted <code>system.web/identity</code> entry:</p>
  
  <p><strong>Failed to decrypt using provider 'DataProtectionConfigurationProvider'. Error message from the provider: The RSA key container could not be opened.</strong></p>
  
  <p>I've followed the steps found in comments at <a href="http://blogs.msdn.com/mosharaf/archive/2005/11/17/protectedConfiguration.aspx" rel="nofollow noreferrer">http://blogs.msdn.com/mosharaf/archive/2005/11/17/protectedConfiguration.aspx</a>, and these are the steps I've done:</p>
  
  <ol>
  <li>Added "xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0"" to the configuration attribute in the web service's web.config</li>
  <li>Create a container using <code>aspnet_regiis -pc "DataProtectionConfigurationProviderKeys" -exp</code></li>
  <li>Added the following to the web.config:
  <code>&lt;configProtectedData&gt;
  &lt;providers&gt;
    &lt;clear /&gt;
    &lt;add name="DataProtectionConfigurationProvider"
         type="System.Configuration.RsaProtectedConfigurationProvider, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a,processorArchitecture=MSIL"
         keyContainerName="DataProtectionConfigurationProviderKeys"
         useMachineContainer="true" /&gt;
  &lt;/providers&gt;
  &lt;/configProtectedData&gt;</code></li>
  <li>Granted access to the key container to the account IIS is running under: <code>aspnet_regiis -pa "DataProtectionConfigurationProviderKeys" "eca\iusr_xxxxx"</code>. I also granted access to the impersonated account (e.g. the one in the identity attribute) using the same command.</li>
  <li>I then encrypted the system.web/identity entry: <code>aspnet_regiis -pef "system.web/identity" "C:\ddrive\EcaDevelopment\EcaApplicationsNet2\Projects\TASV2\Mainline\src\TASV2.WordToPdf.WebSvc" -prov "DataProtectionConfigurationProvider"</code></li>
  </ol>
  
  <p>But, when I try to run my test harness against the web service, I get:</p>
  
  <pre><code>Failed to decrypt using provider 'DataProtectionConfigurationProvider'. Error message from the provider: The RSA key container could not be opened.
  </code></pre>
  
  <p>What have I missed out? Can I actually encrypt just the identity tag? I can encrypt and use the connectionStrings no problem...</p>