Quick thoughts on what we are doing for security with .NET
My work has an initiative to remove all login information from web.config and UDL files. The problem we were facing was that we still had to edit those files when we changed environments. ie., when you move from DEV to QA, you have to change the DB server you were connecting to.
Working with another person here, I developed a 2 level approach for .NET apps.
1 - We are using the built in encryption/decryption in .NET to read a login/password from an encrypted registry setting and have the .NET application impersonate that login. This works well as we are using it to connect it to some HR information.
2 - To deal with the environment issue, I set up a registry setting on all levels of the servers, including DEV, with a single value. It's value is DEV, QA, or PROD. When I need to create a DB connection, I read the registry, determine the environment based on the value and then read out the proper DB connection string from the web.config. The web.config file contains all 3 strings.
Since I am using integrated security, the actual login is hidden. We don't have to worry about someone copying the wrong web.config file into the wrong environment and thus causing issues.
I also connect to a Web Service for some security. We filter certain pages in different applications based on levels of security. I have been able to use the same principal for changing the Web Service URL so that the correct one is being hit.
I am still working out a way to do this with the UDL files, without redoing all of the COM+.
Any comments or ideas would be appreciated.