ValidateUser() fails on IIS but not on Development Server with SqlMembershipProvider - asp.net

Question

I have an MVC4 project which was upgraded from MVC2. While debugging with the VS development server the user validation works fine. But when I tried to debug with Local IIS the login fails, because of a wrong password.
On the production system the user validation also works fine.
The only difference between the development server / production system and local IIS is, that the website is running in an virtual directory on local IIS. So the URLs are
on development server / production something like:
http://localhost:12345/ OR http://the.production.server/
but on local IIS it is somthing like:
http://localhost/mymvcproject/
If I move the website to the root directory on local IIS the login works fine.
In the web.config membership is configured like:
<membership>
<providers>
<add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="ApplicationServices" enablePasswordReset="true" passwordFormat="Encrypted" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" maxInvalidPasswordAttempts="50" minRequiredPasswordLength="6" passwordAttemptWindow="10" applicationName="/" />
</providers>
</membership>
I think the problem is the applicationName parameter, but I haven't changed it.
Things I checked:
the database data were always the same
to create and validate an new user does work on local IIS when in virtual directory
I tested it also with the original MVC2 project, same problem
Am I on the right path?
Is there a way make validation/password encryption/decryption independend from the URL/application name?

Answer 1

Is there a way make validation/password encryption/decryption
independend from the URL/application name?
No. Instead, ASP.Net Membership provider uses Machine Key (in addition to salt) to encrypt and decrypt a password.
Normally, you want to include a machine key in application's web.config explicitly to avoid that kind of saturation.
If you know the machine key, save that in Local IIS's web.config explicitly.
If you do not know the machine key, use the following method to retrieve it.
http://aspnetresources.com/blog/how_to_read_auto_generated_machinekey
Update: 7/9/2013
If you do not assign machine key explicitly, the application will use the auto-generated key by default.

Answer 2

I solved it. Thanks to #Win, you pushed me to the machine key. Just to make it clear, I know the machine key.
I did not see the little IsolateApps parameter in the machine key setting, which is the "key".
With a machine key configured like this:
<machineKey validationKey="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,IsolateApps" decryptionKey="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,IsolateApps" validation="AES" />
I have the behavior like I described in my question. But without the IsolateApps like this:
<machineKey validationKey="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" decryptionKey="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" validation="AES" />
Everything works fine, no matter if the application is in root or a virtual directory. But there's a catch! I you change the machine like this (not the values, only remove the IsolateApps parameter), the user validation fails for existing users. Only new created users can be validated.
The according MSDN page is http://msdn.microsoft.com/en-us/library/vstudio/w8h3skw9(v=vs.100).aspx.