How to hide my login details when impersonating in C#

Question

I have a small section of code that requires elevated security permissions to run it.

I have used the SimpleImpersonation class here to wrap my section of code, I have created a new non-admin user, but I've had to enter the domain, username and password in the code.

using (Impersonation.LogonUser("DOMAIN", "USERNAME", "PASSWORD", LogonType.Interactive))
    {
        // Do stuff 
    }

What's the best way to achieve this impersonation while keeping all the login details secure?

Answer 1

You should move the security-sensitive details into web.config, because configuration files support encryption. Source code, on the other hand, is not encrypted. Although it could be obfuscated, obfuscators would not change the content of string literals.

Fortunately, encrypting parts of web.config is a standard feature. ASP.NET IIS Registration Tool is the tool that you can use to do the encryption. Here is a link to a post describing the process. Here is a link to another very useful article from Microsoft on the same topic: Creating and Exporting an RSA Key Container.

Answer 2

Having that info in the web.config would probably be safer. If you have custom errors turned off and an error is thrown in that code block then you will expose your username and password to the public, you would avoid this if it were in the web.config.

The alternative would be to create the user in a membership table using salt + hashed passwords and request the info as needed, that way you never have the credentials in plaintext