Encrypt Connection String in Web.Config Fails

Question

I would like to encrypt the connection string of my web.config. Here I have found a nice example on how to do this. I implemented this and on my development machine this runs find. However if I upload it to the provider, it does not work with the following error:

[SecurityException: Request failed.] System.Configuration.DpapiProtectedConfigurationProvider.Encrypt(XmlNode node)

In this blog I have read, that this is because of the web probably runs in medium trust and therefore WebConfigurationManager.OpenWebConfiguration can not be used. Instead of this, WebConfigurationManager.GetSection should be used. However, if I get the section as proposed, the call to ProtectSection fails with the following error message:

System.InvalidOperationException: This operation does not apply at runtime

Can anyone lead me to a solution, how I can encode (and decode) the connection string in the web.config file (at runtime)?

Update
Not a real answer to the question, but the hoster gave full trust to the web and now, all worked fine. I leave the quesion open, maybe someone posts a solution to the original question and helps with this people having the same problem but not getting full trust.

kbrimington · Accepted Answer · 2011-04-28 20:58:06Z

1

From http://msdn.microsoft.com/en-us/library/89211k9b%28v=vs.80%29.aspx

static void ToggleWebEncrypt()
{
    // Open the Web.config file.
    Configuration config = WebConfigurationManager.
        OpenWebConfiguration("~");

    // Get the connectionStrings section.
    ConnectionStringsSection section =
        config.GetSection("connectionStrings")
        as ConnectionStringsSection;

    // Toggle encryption.
    if (section.SectionInformation.IsProtected)
    {
        section.SectionInformation.UnprotectSection();
    }
    else
    {
        section.SectionInformation.ProtectSection(
            "DataProtectionConfigurationProvider");
    }

    // Save changes to the Web.config file.
    config.Save();
}

UPDATE

Also, ensure that your service account has write permissions to the Web.config. Also, be aware that granting write permissions to your service account on the Web.config increases somewhat the security footprint of your application. Only do so if you understand and accept the risks.

edited Apr 28, 2011 at 20:58

answered Apr 28, 2011 at 20:49

kbrimington

25.7k5 gold badges67 silver badges75 bronze badges

Sign up to request clarification or add additional context in comments.

10 Comments

HCL Over a year ago

Thanks for your answer. However is the line Configuration config = WebConfigurationManager.OpenWebConfiguration("~"); the source of the exception, IIS does not execute it and throws a SecurityException!

kbrimington Over a year ago

@HCL: Does your service account have write permissions on the web.config file?

HCL Over a year ago

@kbrimington: Yes, the configuration tool of the hoster allows me to grant permission on a directory base and I gave testwise IUSR read/write permissions on the root (also of the virtual directory).

HCL Over a year ago

@kbrimington: It seems really like the Shahed Khan writes in his post, the description of the error is as follows: The application attempted to perform an operation not allowed by the security policy. To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file

kbrimington Over a year ago

@HCL: Am I correct that it is still not working? If so, note that unless you are using impersonation, granting IUSR permissions does not solve the problem. It is the service account, not the user account that needs write permissions. You can use Environment.UserName to ferret out the name of the account, if you don't know it already.

|

Collectives™ on Stack Overflow

Encrypt Connection String in Web.Config Fails

1 Answer 1

10 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

10 Comments

Your Answer

Sign up or log in

Post as a guest

Related