VB.NET secure database login
Dear Gurus,
Would appreciate some guidance how best to go around creating a secure login form for SQL server authentication (non windows based authentication for now). I have gotten the form working fine (Application is winforms based) but would like to store the credentials supplied by the user (Username & password) dynamically and securely in memory to dynamically build the connection strings as needed without having to re ask the end user to supply the credentials.
Till now I have the following possible scenarios that may work:
Any assistance with the above is greatly appriciated
Would appreciate some guidance how best to go around creating a secure login form for SQL server authentication (non windows based authentication for now). I have gotten the form working fine (Application is winforms based) but would like to store the credentials supplied by the user (Username & password) dynamically and securely in memory to dynamically build the connection strings as needed without having to re ask the end user to supply the credentials.
Till now I have the following possible scenarios that may work:
Pass the values of the two text boxes to the constructor of the main application screen and store the values in memory ( have some concerns re run time attacks )
After some research the Securestring function seemed very interesting to store the password value in a encrypted format but I got a bit confused on how to actually use it ( decrypt the string and deploy that value in the connection string)
Any assistance with the above is greatly appriciated
Do more with
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
@Nicholas Xerri - Ideally you should use Windows Authentication.
However, if you can't use Windows Authentication only then I'm assuming your SQL Server is configured to use Mixed Mode Authentication.
Is your application using a dedicated account to connect to SQL Server and your App users multiple user IDs stored in a SQL table?
If so, then you could perhaps create some host lookup table that SQL Server checks after a user logins for the first time:
1. If host is not found force login using authorize user lookup table.
2. Store host info after successful login.
3. Future visits would validate user against host table.
4. If authorized then allow access and skip password requirement.
You can obtain connecting client information using something like the following:
However, if you can't use Windows Authentication only then I'm assuming your SQL Server is configured to use Mixed Mode Authentication.
Is your application using a dedicated account to connect to SQL Server and your App users multiple user IDs stored in a SQL table?
If so, then you could perhaps create some host lookup table that SQL Server checks after a user logins for the first time:
1. If host is not found force login using authorize user lookup table.
2. Store host info after successful login.
3. Future visits would validate user against host table.
4. If authorized then allow access and skip password requirement.
You can obtain connecting client information using something like the following:
SELECT hostname,
net_library,
net_address,
client_net_address
FROM sys.sysprocesses AS S
INNER JOIN sys.dm_exec_connections AS decc ON S.spid = decc.session_id
WHERE spid = @@SPID
The Database is in Azure hence the SQL accounts since im still working on getting Azzure AD working. No the application does not use a static account to talk to the database rather the user supplied credentials actually form part of the connection string.
There is no user table, rather I am using SQL Login commands to create the users. My issue is how to store the user supplied username and password in memory securely once the login screen has done its job (connection was successfully established to the database and closed hence validating the supplied credentials). The idea is to be able to dynamically build connection strings based on the user supplied credentials, but I don't want to prompt them for credentials every so often.
There is no user table, rather I am using SQL Login commands to create the users. My issue is how to store the user supplied username and password in memory securely once the login screen has done its job (connection was successfully established to the database and closed hence validating the supplied credentials). The idea is to be able to dynamically build connection strings based on the user supplied credentials, but I don't want to prompt them for credentials every so often.
@Nicholas Xerri - Microsoft suggests that a password handling best practice when using Windows Forms with Azure is:
As a proof of concept one option would be to create a Microsoft Account for each user, and then have your app leverage the saved credentials from the MS account for authentication. Your application needs to be configured as a Mobile or Desktop Client application on the API settings page for this library to work - https://github.com/rgregg/microsoft-account-winforms
If that's not an option take look at Chapter 15: Internet - Windows Forms Client to Remote WCF Using Message Security (Original Caller, HTTP) - https://msdn.microsoft.com/en-us/library/ff648163.aspx
The login and password to SQL Azure should never be stored in the code running on the desktop.
The login and password shouldn’t be stored on the the user’s hard drive.
Every desktop user should have their own login and password to SQL Azure.
As a proof of concept one option would be to create a Microsoft Account for each user, and then have your app leverage the saved credentials from the MS account for authentication. Your application needs to be configured as a Mobile or Desktop Client application on the API settings page for this library to work - https://github.com/rgregg/microsoft-account-winforms
If that's not an option take look at Chapter 15: Internet - Windows Forms Client to Remote WCF Using Message Security (Original Caller, HTTP) - https://msdn.microsoft.com/en-us/library/ff648163.aspx
Premium Content
You need an Expert Office subscription to comment.Start Free Trial