This article demonstrates how you can use encrypted connection strings with Telerik OpenAccess ORM within your web applications.

After a web application is built and deployed to the IIS, the web.config’s ‘connectionStrings’ section can be encrypted. This can be done by using the ASP.NET Registration Tool (aspnet_regiis.exe).

See the following command executed on the command line (The command line needs to be started with administrative rights):

aspnet_regiis -pe "connectionStrings" -app "/YourWebsiteName"

After the command is executed, the connection strings in the web.config file of the specified website are encrypted. An example could look like this:

<?xml version="1.0"?>
   <connectionStrings configProtectionProvider="RsaProtectedConfigurationProvider">
     <EncryptedData Type=""
       <EncryptionMethod Algorithm="" />
       <KeyInfo xmlns="">
         <EncryptedKey xmlns="">
           <EncryptionMethod Algorithm="" />
           <KeyInfo xmlns="">
             <KeyName>Rsa Key</KeyName>

When encrypting configuration entries, different encryption providers can be chosen or a custom provider can be used. By default Microsoft is offering two providers: ‘RsaProtectedConfigurationProvider’ and ‘DPAPIProtectedConfigurationProvider’. More details on providers can be found in the MSDN documentation.

In this case, the ‘RsaProtectedConfigurationProvider’ was used, which is also the default provider and no other provider was specified in the command before.

Once the web.config file is encrypted, the user which is defined as the user of the application pool, needs to get the rights to access the encryption keys needed by the ‘RsaProtectedConfigurationProvider’. In this example the user “NT AUTHORITY\NETWORK SERVICE” is defined as the application pool user. The grants to the encryption keys, in this case the ‘NetFrameworkConfigurationKey’, which is the key container specified for the default provider, can be given with the following command:

aspnet_regiis -pa "NetFrameworkConfigurationKey" "NT AUTHORITY\NETWORK SERVICE"

Now the configuration file is encrypted and the user defined in the application pool is allowed to use the keys needed by the respective provider. Now what needs to be done in the OpenAccess code? The answer is: Nothing! Everything works out of the box.

More details about how to encrypt configuration files, define custom providers and key management can be found in the respective MSDN documentation.

Click to download your free copy of OpenAccess

About the Author

Ralph Waldenmaier

 is Senior Software Developer in Telerik OpenAccess ORM


Comments are disabled in preview mode.