Federated Authentication on Azure

If you don't specify machineKey in configuration, Azure adds one. But if you create new version of your application and deploy it to Azure using VIP switching, Azure generates a new machine Key for the deployment in Staging (assuming your first deployment was to Production). (VIP switching is nice mechanism for deploying new version and then switching virtual IP addresses between Production and Staging).

So basically one solution is letting Azure to generate the key but after VIP switch you have the problem back. To avoid it you can catch the CryptographicException in Global.asax in Application_Error handler, something like this:

// Be sure to reference System.IdentityModel.Services// and include using System.IdentityModel.Services; // at the start of your classprotected void Application_Error(object sender, EventArgs e){    var error = Server.GetLastError();    var cryptoEx = error as CryptographicException;    if (cryptoEx != null)    {        FederatedAuthentication.WSFederationAuthenticationModule.SignOut();        Server.ClearError();    }}

The SignOut() method causes the cookie is removed.

Edit: updated info on generating machineKey as noted by @anjdreas.

Another solution is to generate the machineKey, you can use IIS Manager to do it, see Easiest way to generate MachineKey for details. If you put the same key into all your web appliactions within Azure Web Role, the Azure deployment process will not replace it.

The machine key shouldn't be there: Windows Azure generates one for you and makes sure it is identical on every instance in your role.

About the error you're seeing: can you try clearing cookies?

Simply clearing the cookies solved the whole problem for me in this case.