asked on

VB.NET secure database login

Dear Gurus,

Would appreciate some guidance how best to go around creating a secure login form for SQL server authentication (non windows based authentication for now). I have gotten the form working fine (Application is winforms based) but would like to store the credentials supplied by the user (Username & password) dynamically and securely in memory to dynamically build the connection strings as needed without having to re ask the end user to supply the credentials.

Till now I have the following possible scenarios that may work:

Pass the values of the two text boxes to the constructor of the main application screen and store the values in memory ( have some concerns re run time attacks )

After some research the Securestring function seemed very interesting to store the password value in a encrypted format but I got a bit confused on how to actually use it ( decrypt the string and deploy that value in the connection string)

Any assistance with the above is greatly appriciated

LajuanTaylor

@Nicholas Xerri - Ideally you should use Windows Authentication.

However, if you can't use Windows Authentication only then I'm assuming your SQL Server is configured to use Mixed Mode Authentication.

Is your application using a dedicated account to connect to SQL Server and your App users multiple user IDs stored in a SQL table?

If so, then you could perhaps create some host lookup table that SQL Server checks after a user logins for the first time:
1. If host is not found force login using authorize user lookup table.
2. Store host info after successful login.
3. Future visits would validate user against host table.
4. If authorized then allow access and skip password requirement.

You can obtain connecting client information using something like the following:

SELECT  hostname,
        net_library,
        net_address,
        client_net_address
FROM    sys.sysprocesses AS S
INNER JOIN    sys.dm_exec_connections AS decc ON S.spid = decc.session_id
WHERE   spid = @@SPID

Open in new window

Nicholas Xerri

ASKER

The Database is in Azure hence the SQL accounts since im still working on getting Azzure AD working. No the application does not use a static account to talk to the database rather the user supplied credentials actually form part of the connection string.

There is no user table, rather I am using SQL Login commands to create the users. My issue is how to store the user supplied username and password in memory securely once the login screen has done its job (connection was successfully established to the database and closed hence validating the supplied credentials). The idea is to be able to dynamically build connection strings based on the user supplied credentials, but I don't want to prompt them for credentials every so often.

ASKER CERTIFIED SOLUTION

LajuanTaylor

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial