DPAPI can be used to encrypt the secret data.
We intend to use it in our web app to encrypt some data and store the encrypted data in database. When needed we decrypt the data and present them on UI(web page). It works well if we hosted the web app on a single web server. But the problem appears when we migrate it to a load balance environment - hosting the web app on multiple web server. Because the app cannot decrypt the data which encrypted on another machine.
We refer to some information from internet, it looks like we need to config a roaming user account and run the application pool with that account.
The reason we want to use DPAPI is that it will not involve additional management work on the keys.
Do you have some similar experience, how do you solve the problem? Or some other suggestions?
There are two relatively small changes you should make to your setup.
First of all, you should always be using DPAPI in
Secondly, you should be using the DPAPI classes to encrypt your encryption key - not the data directly.