Title: Asp.Net membership login & machine key
Tags: asp.net;iis-7;web;asp.net-membership;machinekey
Question: I have a .Net application that uses the ASP.Net membership login control for authentication. I had my application published on IIS7 as a web site (www.mysite.com). Everything working fine.
Now I created a new Web site and in it i have added an application that contains my publish(www.site.com/mysite). On this publish i cannot login anymore (i get a "Fail" error). After a lot of searches on the internet i have found that the problem is caused by the autogenerated machine key in my application (i did not have a machine key set in web.config).
Now i cannot set a machine key because i already have user created in my application and if setting the machine key they will not be able to login anymore.
My question is how can i force the new web site (www.site.com/mysite) to use the same machine key as the first one? I have tried setting the same AppPool but no luck.
Remark: i have other publishes that works ok and uses same machine key but they are all root applications on the web sites (like www.mysecondsite.com). What happens/what is different on this configuration wwww.site.com/mysite that causes the application to generate new keys?


Here is another answer: Not sure why no one answered this earlier.
You can enter it directly in Web.Config.  or over type the value there.
Careful... any application data using encryption  with this as the key is broken afterwards.
Generally you set up the machine per site and leave it.
The validation key is used for encryption. Ie password matching asymmetric approach.
The decryption key is used when decrypting data to get original content (symmetric)
<system.web&gt;
<machineKey decryptionKey="3815E48D71E4A60848B5213F1BBD7A2FEDAB229873421929"
validationKey="3CB08C9B349194F28A340FBDA33BC94F7037FACCF9973CAFCAE4501D7F903BA7C539219FDCA77E2F864D848A60F249B639ED28925B90B3F7EECBB9A70EBE1607" /&gt;
</system.web&gt;
Comment for this answer: If the sites have used a machine key and with Encryption. Then  you can not retrieve the passwords. (Well it is monumental task for a hacker). if you change the machine key, you can not access the passwords.  You CAN with code a CUSTOM logon tool, try 2 machine keys. This is a large programming exercise as it requries a custom membership provider implementation.  You may like to Edit the original question with more details on what you would like/need to do.  It doesnt sound good sorry.
Comment for this answer: Thank you for the solution @soadyp but this not solves my problem. Indeed the machineKey entry from web.config will have spared me from all this problems if it have been set from the beginning. But i did not specify a machine key when first published the application and users where created in the system that i cannot alter. Now i cannot set a machine key because this will make the users to not be able to login with their old passwords. My question is do i have a solution to set machine key without altering the users passwords?

{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 1, 'CommentCount': 0, 'ContentLicense': 'CC BY-SA 3.0', 'CreationDate': '2012:00:08/27/12', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<asp.net><iis-7><web><asp.net-membership><machinekey>', 'Title': 'Asp.Net membership login & machine key', 'ViewCount': 2216, 'id': 12138023, 'user_AboutMe': None, 'user_AccountId': 1784649.0, 'user_DisplayName': 'user1626401', 'user_Reputation': 1.0, 'user_Views': 2.0, 'user_id': 1626401.0}}