Develop Reference

How to Protect My Configuration File

I am writing an SQL Server application in C# built in Visual Studio. It is a Windows Forms Application. The program will be installed on the network where users will run it.
The problem I am struggling with is how to manage the configuration file. It has the server username and password there for all to see. I tried Click Once and an encryption scheme but they both required the programs to run on the computer the program was running from. It failed when I tried to run it from a workstation. This is different from How do I avoid having the database password stored in plaintext in sourcecode? because all of those solutions either suggested using integrated security or machine based encryption. Neither of those options would work for me.
Any help would be deeply appreciated.

Don't store passwords in plain text. Period. Full stop.
You should take a cue from SQL Server. Yes, you can store usernames in passwords in plain text in a web/app.config. But for Production servers you never should. Instead for Production deployments you should have a config that uses Integrated Security. That allows for elevated access by accessing credentials which are handled securely by Windows rather than insecurely in a config file.
Similarly, you should use something like WindowsIdentity, or OpenId. Then you can pass around auth tokens in your code rather than storing credentials in plain text.

This is why software developers created multi-tier designs that include middleware services like web services. Web services can be hosted in IIS and the windows account and password can be configured into the Application Identity section of the application connection pool. Then the web.config connection string can be configured with trusted_connection=true. Configuring it this way uses the Windows Data Protection API to protect the identities.

If you mean data at app.config it is simple! You have to use these two classes:
EntityConnectionStringBuilder
https://msdn.microsoft.com/en-us/library/system.data.entityclient.entityconnectionstringbuilder(v=vs.110).aspx
And
SqlConnectionStringBuilder
https://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlconnectionstringbuilder(v=vs.110).aspx
I learn it from this page: Programmatic Connection Strings in Entity Framework 6 It is very good guide. In any cases, That link didn't help you!? Just Google something like this:
C# define connection string at runtime
After you put all connection string inside your code, you can go and delete any sensitive data from connectionStrings tag of app.config file because your app will not use it anymore! Then compile your code again.
If you are using DB First in EF, then you can check this Guide too: How to set Connection String with Entity Framework
UPDATED:
I added two of my Classes that I manage and create connection string with them programmatic (Dynamic), One is belong to my Entity Framework project that I used SQL Server Compact Edition (SQL Server CE) and the second one belong to another Entity Framework Project That I used SQL Server Express 2014 with SQL Server authentication (used sa username). I will leave both method here in case anyone need them:
This belong to my SQL Server CE project:
public static string GetDBConnectionString(string dataParentPath = "")
{
EntityConnectionStringBuilder entityBuilder = new EntityConnectionStringBuilder();
SqlCeConnectionStringBuilder sqlCEBuilder = new SqlCeConnectionStringBuilder();
if (string.IsNullOrEmpty(dataParentPath) == true)
dataParentPath = #"C:\MyDBFolder\CMS.sdf";
sqlCEBuilder.DataSource = dataParentPath;
sqlCEBuilder.Password = "12345687";
sqlCEBuilder.MaxDatabaseSize = 4090;
entityBuilder.Metadata = "res://*/CMS.csdl|res://*/CMS.ssdl|res://*/CMS.msl";
entityBuilder.ProviderConnectionString = sqlCEBuilder.ToString();
entityBuilder.Provider = "System.Data.SqlServerCe.4.0";
return entityBuilder.ToString();
}
This belongs to my SQL Server Express project with SQL Server authentication:
using System;
using System.Collections.Generic;
using System.Data.Entity.Core.EntityClient;
using System.Data.SqlClient;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace CMS
{
class mySettings
{
public static string GetDBConnectionString()
{
// **************************************************
// This is my "ConnectionString" from App.config file.
// <connectionStrings>
// <add name="CMSEntities"
// connectionString=
// "metadata=res://*/CMS.csdl|res://*/CMS.ssdl|res://*/CMS.msl
// ;provider=System.Data.SqlClient
// ;provider connection string=&quot
// ;data source=MY-PC\SQLEXPRESS
// ;initial catalog=CMS
// ;user id=sa
// ;password=12345687
// ;MultipleActiveResultSets=True
// ;App=EntityFramework
// ""
// providerName="System.Data.EntityClient" />
//</connectionStrings>
// **************************************************
string metaData = "res://*/CMS.csdl|res://*/CMS.ssdl|res://*/CMS.msl";
string providerName = "System.Data.SqlClient";
string dataSource = #"MY-PC\SQLEXPRESS";
string databaseName = "CMS"; // = InitialCatalog
string userID = "sa";
string password = "12345687";
string appName = "EntityFramework";
EntityConnectionStringBuilder entityBuilder = new EntityConnectionStringBuilder();
SqlConnectionStringBuilder sqlBuilder = new SqlConnectionStringBuilder();
// = = = = = = = = = = = = = = = =
sqlBuilder.DataSource = dataSource;
sqlBuilder.InitialCatalog = databaseName;
sqlBuilder.MultipleActiveResultSets = true;
sqlBuilder.UserID = userID;
sqlBuilder.Password = password;
sqlBuilder.ApplicationName = appName;
// = = = = = = = = = = = = = = = =
entityBuilder.Provider = providerName;
entityBuilder.Metadata = metaData;
entityBuilder.ProviderConnectionString = sqlBuilder.ConnectionString;
return entityBuilder.ToString();
}
}
}
As you can see, My database in both project have same name "CMS" so its Entities will be named "CMSEntities". Now! you have to override its DbContext constructor. It is Important but easiest part! Better description than mine is from this page "http://www.cosairus.com/Blog/2015/3/10/programmatic-connection-strings-in-entity-framework-6":
Now your Entity Model extends from DbContext and DbContext provides a
constructor to pass in a Connection String, but your Entity Model does
not overload those constructors for you. In order to access the
constructor overload, you will need to create a new class partial for
your Entity Model database context in the same namespace as your
Entity Model with the required constructor signature. Pro Tip: be sure
to name the filename of the cs file a different name than the Entity
Model database context in the event that future generated code does
not overwrite your changes.
So I build a class at root of my Project, The class must be partial:
using System;
using System.Collections.Generic;
using System.Data.Entity;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace CMS // Your Project Namespace
{
public partial class CMSEntities : DbContext
{
public CMSEntities(string connectionString)
: base(connectionString)
{
}
}
}
and Anytime I wanna access to my Database I will use this code:
using (CMSEntities db = new CMSEntities(CMSSettings.GetDBConnectionString()))
{
// Do your DB stuff here...
}
I hope It help you or others which I learn all of that from this site "stackoverflow" and users.
Good Luck

Changing the EF connection string gives - Keyword not supported: 'metadata'

For the past few hours I've been looking into this problem, found many similar topics but none of them seems to help.
I have a C# application that uses the Entity Framework 5 and I have a .edmx data model that works fine when using the connection string from the app config file.
Now I would like to change the connection string during runtime, but it throws an exception that says:
Keyword not supported: 'metadata'.
Here is the code that I have:
private string GetNewConnectionString(string server, string database, string username, string password)
{
var sqlBuilder = new SqlConnectionStringBuilder()
{
DataSource = server,
InitialCatalog = database,
UserID = username,
Password = password,
IntegratedSecurity = true,
MultipleActiveResultSets = true
};
var entityBuilder = new EntityConnectionStringBuilder()
{
Provider = "System.Data.SqlClient",
ProviderConnectionString = sqlBuilder.ToString(),
Metadata = "res://*/MyTestModel.MyTestModel.csdl|res://*/MyTestModel.MyTestModel.ssdl|res://*/MyTestModel.MyTestModel.msl"
};
return entityBuilder.ToString();
}
public void insertInDB()
{
var newConnectionString = GetNewConnectionString(server, database, username, password);
//newConnectionString = newConnectionString .Replace("\"", """); // doesn't help
//newConnectionString = newConnectionString .Replace("\"", "'"); // doesn't help either
using (var context = new MyTestModel.MyEntities(newConnectionString)) // it crashes here
{
}
}
The metadata should be correct, because I have copied it from the app config file, also if I copy the value of newConnectionString to the app config and use it, it works fine if I replace the quotations with ".
This is the value of newConnectionString (i've only replaced the credentials with some dummy credentials):
metadata=res:///MyTestModel.MyTestModel.csdl|res:///MyTestModel.MyTestModel.ssdl|res://*/MyTestModel.MyTestModel.msl;provider=System.Data.SqlClient;provider
connection string="Data Source=myServer;Initial
Catalog=myDatabase;Integrated Security=True;User
ID=myDbUser;Password=myDbUserPassword;MultipleActiveResultSets=True"
I cannot see what is wrong with it, can anybody spot something?

This answer: Entity Framework change connection at runtime solves the problem
I cannot understand what the problem with my code was, but it works fine with the extension method from the link.

Set Entity Framework Connection String at Runtime in C#

I need to set my Entity Framework connection string at runtime. Right now, I have the following:
string connectionString = "metadata=res://*/DataModels.CustomerDataModel.csdl|res://*/DataModels.CustomerDataModel.ssdl|res://*/DataModels.CustomerDataModel.msl;provider=System.Data.SqlClient;provider connection string="data source=tcp:{serverName},{portNumber};initial catalog={databaseName};user id={username};multipleactiveresultsets=True;application name=EntityFramework"";
using (CustomerEntities entities = new CustomerEntities(connectionString))
{
CustomerEntity entity = new CustomerEntity();
// do more
entities.CustomerEntities.Add(entity);
entities.SaveChanges();
}
When I execute the code above (with the {parameter} values replaced), I get the following error:
Keyword not supported: 'data source'.
What am I doing wrong?

Change this.
string connectionString = "metadata=res://*/DataModels.CustomerDataModel.csdl|res://*/DataModels.CustomerDataModel.ssdl|res://*/DataModels.CustomerDataModel.msl;provider=System.Data.SqlClient;provider connection string="data source=tcp:{serverName},{portNumber};initial catalog={databaseName};user id={username};multipleactiveresultsets=True;application name=EntityFramework"";
To this (note how i escaped the " character as "" )
string connectionString = #"metadata=res://*/DataModels.CustomerDataModel.csdl|res://*/DataModels.CustomerDataModel.ssdl|res://*/DataModels.CustomerDataModel.msl;provider=System.Data.SqlClient;provider connection string= ""data source=tcp:{serverName},{portNumber};initial catalog={databaseName};user id={username};multipleactiveresultsets=True;application name=EntityFramework""";

I know this was asked 10 months ago, but I found an easier way to specify the connectionString:
If your config file has it as:
<connectionStrings>
<add name="CustomerDataModel" connectionString="metadata=res://*/EntityFramework.CustomerDataModel.csdl|res://*/EntityFramework.CustomerDataModel.ssdl|res://*/EntityFramework.CustomerDataModel.msl;provider=System.Data.SqlClient;provider connection string="data source=.\CustomerDataModel;initial catalog=CustomerDB;integrated security=True;multipleactiveresultsets=True;App=EntityFramework"" providerName="System.Data.EntityClient" />
You can specify it as -
public const string ConnectionString = #"name=CustomerDataModel";
..
CustomerDBContext context = new CustomerDBContext(ConnectionString );
No need to worry about quotes. Lot cleaner.

It is easier to use EntityConnectionStringBuilder and SqlConnectionStringBuilder to change parameters as you want.

set multiple connection strings in your web.config, and follow below:
public partial class MyDatabaseEntities
{
public MyDatabaseEntities(string connection)
: base(connection)
{
}
}
and then wherever you want to create instance of entities, pass connection string name in parameter:
MyDatabaseEntities entities = new MyDatabaseEntities("CONNECTION_STRING_NAME");
I hope this will help.
Thanks

Providing connection string to an EF 5.0 model

So I guess this is really simple, but for some reason I'm unable to find the answer. My problem is that I've before used EF 4.3.1 contexts that inherit from ObjectContext, and the autogeneration always created an overloaded constructor that accepted the connection string as a parameter.
Now that I'm trying to switch to EF 5.0, I have to use the DbContext version. But MyEntities that is inherited from DbContext, has only the parameterless constructor available. I guess I could add the overloaded constructor myself, and make it call base(connectionString), but doing manual changes to the auto-generated file just seems like a risky business at best.
So how can I create an instance of MyEntities that uses a connection string that I provide at runtime?

Have you tried using the connectionFactory?
This example is for SqLite, but it applies to all databases.
You can make a class similar to this one:
public class SqLiteConnectionFactory : IDbConnectionFactory
{
public System.Data.Common.DbConnection CreateConnection(string nameOrConnectionString)
{
var databaseDirectory = #"C:\\master.db";
var builder = new SQLiteConnectionStringBuilder
{
DataSource = databaseDirectory,
Version = 3
};
return new SQLiteConnection(builder.ToString());
}
}
and then use if by executing this statement before you access your context the first time:
Database.DefaultConnectionFactory = new ConnectionFactories.SqLiteConnectionFactory ();

Here is a function to build your connection string (for firebird here):
private static string ConnectionString(string dbFileName)
{
// Specify the provider name, server and database.
const string providerName = "FirebirdSql.Data.FirebirdClient";
const string metaData = "res://*/RcModel.csdl|res://*/RcModel.ssdl|res://*/RcModel.msl";
// Initialize the EntityConnectionStringBuilder.
EntityConnectionStringBuilder entityBuilder = new EntityConnectionStringBuilder();
//Set the provider name.
entityBuilder.Provider = providerName;
FbConnectionStringBuilder sqlBuilder = new FbConnectionStringBuilder();
sqlBuilder.UserID = "sysdba";
sqlBuilder.Password = "masterkey";
sqlBuilder.DataSource = #"127.0.0.1";
sqlBuilder.Database = dbFileName;
sqlBuilder.Dialect = 3;
sqlBuilder.Charset = "UTF8";
sqlBuilder.ServerType = FbServerType.Default;
// Set the provider-specific connection string.
entityBuilder.ProviderConnectionString = sqlBuilder.ConnectionString;
entityBuilder.Metadata = metaData;
return entityBuilder.ToString();
}
Use it that way:
string cs = ConnectionString(#"C:\myDbFile.fbd");
EntityConnection conn = new EntityConnection(cs);
MyEntities db = new MyEntities(conn);

You can do it where you create MyEntities. Something like this:
MyEntities dataContext = new MyEntities();
dataContext.Database.Connection.ConnectionString = "<YOUR CONNECTION STRING>";
If your edmx is setup to look for a connection string in your config it will still do so when created but you can strip out the database provider connection string that embedded inside it. After doing that it would look something like this (if connecting to SQL):
<connectionStrings>
<add name="MyEntities" connectionString="metadata=res://*/MyEntities.csdl|res://*/MyEntities.ssdl|res://*/MyEntities.msl;provider=System.Data.SqlClient;provider connection string=;" providerName="System.Data.EntityClient" />
</connectionStrings>

Database Connection String Info

In .Net is there a class in .Net where you can get the DB name, and all the connection string info without acutally doing a substring on the connection string?
EDIT:
I am not creating a connection I am attempting to get info out of the connection string. So I am basicly looking for something that takes a connection string arg and has accessors to dbName, connection type, etc....

You can use the provider-specific ConnectionStringBuilder class (within the appropriate namespace), or System.Data.Common.DbConnectionStringBuilder to abstract the connection string object if you need to. You'd need to know the provider-specific keywords used to designate the information you're looking for, but for a SQL Server example you could do either of these two things:
Given
string connectionString = "Data Source = .\\SQLEXPRESS;Database=Northwind;Integrated Security=True;";
You could do...
System.Data.Common.DbConnectionStringBuilder builder = new System.Data.Common.DbConnectionStringBuilder();
builder.ConnectionString = connectionString;
string server = builder["Data Source"] as string;
string database = builder["Database"] as string;
Or
System.Data.SqlClient.SqlConnectionStringBuilder builder = new System.Data.SqlClient.SqlConnectionStringBuilder();
builder.ConnectionString = connectionString;
string server = builder.DataSource;
string database = builder.InitialCatalog;

After you initialize the connection with the connection string, you can get those information from properties of the initialized connection object.
Check System.Data.Common.DbConnection.

ConnectionInfo connectionInfo = new ConnectionInfo ();
connectionInfo = logOnInfo.ConnectionInfo;
connectionInfo.DatabaseName = database;
connectionInfo.ServerName = server;
connectionInfo.Password = password;
connectionInfo.UserID = user;
EDIT: Looks like Nathan beat me to it, as mine is from the same page.
EDIT AGAIN: I should note that ConnectionInfo is in the CrystalDecisions.Shared namespace. As for how to get it from a generic DB connection, I'm not sure.

Yep ConnectionInfo
http://msdn.microsoft.com/en-us/library/ms226340(VS.80).aspx
EDIT: I, along with Chris, realized that this is only works if you have the Crystal Reports namespaces imported. Otherwise I'm not sure

if you build your connection string using the Connection string builder (e.g. OracleConnectionStringBuilde, and it will be different for different database), in that case easily retrieve the information out of it.
here it explained:
http://msdn.microsoft.com/en-us/library/ms254947.aspx

SqlConnection sq = new SqlConnection(ConnectionString);
Reference
Done with "using" statement (from MSDN)
using (SqlConnection connection = new SqlConnection(connectionString))
{
connection.Open();
// Do work here; connection closed on following line.
}