orchardcore-azure-data-protection

Orchard Core Azure Data Protection - Prompt Templates

Module Overview

The OrchardCore.DataProtection.Azure module enables storing ASP.NET Core Data Protection key rings in Azure Blob Storage. This is essential for load-balanced and multi-instance deployments where all instances must share the same key ring.

Data Protection is a core ASP.NET Core security mechanism used by Orchard Core to safeguard:

• Authentication cookies
• Anti-forgery tokens
• Decryptable persisted secrets (e.g., SMTP credentials, excluding user passwords)
• Temporary data (TempData)

Keys are automatically isolated per tenant within the configured container.

Configuration

Guidelines

• Enable the OrchardCore.DataProtection.Azure feature.
• Provide a valid Azure Storage account connection string.
• The container name must be a valid DNS name and conform to Azure naming rules (lowercase only).
• Set CreateContainer to true (default) to auto-create the container on startup.
• This feature is critical for multi-instance deployments (load-balanced, scaled-out) where all instances must share the same data protection keys.
• Without shared key storage, authentication cookies and anti-forgery tokens will fail across instances.

Configuration Properties

Property	Description	Default
ConnectionString	Azure Storage account connection string (required).	""
ContainerName	Azure Blob container name (lowercase, valid DNS name).	"dataprotection"
BlobName	Specific blob name for storing keys (optional, defaults to tenant-specific path).	""
CreateContainer	Whether to auto-create the container if it doesn't exist.	true

Basic Configuration

Add to appsettings.json:

{
  "OrchardCore": {
    "OrchardCore_DataProtection_Azure": {
      "ConnectionString": "DefaultEndpointsProtocol=https;AccountName=myaccount;AccountKey=mykey;EndpointSuffix=core.windows.net",
      "ContainerName": "dataprotection",
      "BlobName": "",
      "CreateContainer": true
    }
  }
}