Microsoft.AspNetCore.DataProtection - PersistKeysToDbContext - Key was not found in the key ring. Unprotect operation cannot proceed.

[pomodororosso]

Setup

Azure - AspNetCore - Duende - Federated login flow

Azure.Extensions.AspNetCore.DataProtection.Keys => 1.4.0
Microsoft.AspNetCore.DataProtection.EntityFrameworkCore => 8.0.15

• Microsoft.AspNetCore.DataProtection => 8.0.15
• Microsoft.AspNetCore.DataProtection.Abstractions => 8.0.15

services.AddDataProtection() .PersistKeysToDbContext<ApplicationDbContext>() .ProtectKeysWithAzureKeyVault(new Uri(dataProtectionKeyvaultUri), tokenCredential) .SetApplicationName("MyApp");

Problem

When a key expires and "Policy resolution states that a new key should be added to the key ring.". A new key is created, saved to the database and that key is set as the default.

The new key is used successfully to protect data. Any subsequent attempt to unprotect the data with the same key errors with e.g. "Key {3d55f7a6-1819-49c7-be49-7033410ecc14} was not found in the key ring. Unprotect operation cannot proceed."

I'm forced to restart the application which then successfully reads the key ring from the database and once again selects the same key as its default but is then able to protect/unprotect data without error.

Any help on how to solve or troubleshoot would be appreciated.