|
|
|||||||||
|
|||||||||
|
|||||||||
| |
||
| |||||||||
![]() |
|
|
«
Previous Thread
|
Next Thread
»
|
Thread Tools | Search this Thread | Rate Thread | Display Modes |
|
#1
|
|||
|
|||
|
how to log into sql securely
Hi, my asp.net application is accessing a mssql on another server. This works fine when I use this in my web.config file:
<addkey="dbkey"value="server=192.12.12.1;database=mydb;user=dbuser;passw ord=mypassword"/> However I don't like to store my password in plain text. I played around with aspnet_setreg.exe and I followed those instructions: http://support.microsoft.com/default.aspx?scid=kb;en-us;Q329290 However my application says 'Could not create Windows user token from the credentials specified in the config file' when I use it in the recommended way: <identityimpersonate="true" userName="registry:HKLM\SOFTWARE\MYDB\identity\ASPNET_SETREG ,userName" password="registry:HKLM\SOFTWARE\MYDB\identity\ASPNET_SETREG ,password" /> I don't really need the asp.net worker process to run impersonate. All I need is to store and transmit the password encrypted. Does anyone have a suggestion? Thanks, Markus |
|
#2
|
||||
|
||||
|
if you don't want to send passwords in plain text you only have 2 options (both windows integrated security)
1) add every user to the db and let asp.net impersonate 2) put a domain user on the worker process number 1 is easy and dirty, it also makes it possible for users to use sql tools to bypass your app en access the db directly (perfect for abuse) number 2 is not so easy as it sounds (if you're unlucky u will have to change the application pools too) i can tell you now, this stuff has given me and my co-workers headaces for weeks, epecialy is you're having multiple OS in your users pool ![]() |
![]() |
| Viewing: ASP Free Forums > Database > Microsoft SQL Server > how to log into sql securely |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
|
|