Re: Data encryption ?

From: Paul Glavich [MVP - ASP.NET] (glav_at_aspalliance.com-NOSPAM)
Date: 04/12/04 

Date: Mon, 12 Apr 2004 20:53:56 +1000

Well fair enough. I personally dont mind the registry at all and use it all
the time. However, given you dont want to do that, then perhaps just use a
separate configuration section, whether it be in the <appSettings> element,
or in your own custom section, that defines the user and the encrypted
password in the encrypted format of your choosing (I assume your own
personal library), then in code do the impersonation. Yes its more work, but
I am not aware of any easy method to intercept the supplying of the password
to the "impersonation engine" and I suspect that if there is a method to do
this, it would probably be a bit more work and complexity than simply
impersonating a user in code.

Hope that helps somewhat. 

--
- Paul Glavich
Microsoft MVP - ASP.NET
"WJ" <JWebb@Msn2.Com> wrote in message
news:uCkLbH8HEHA.3032@TK2MSFTNGP09.phx.gbl...
> Paul,
>
> Thanks for the reply. Actually, this util uses DPAPI tool which I try to
> avoid. The reason is I attempt to avoid having to use the Windows Registry
> DB at all cost. My thinking is that I will try to mess with the
Global.asax
> to see if there is a way around. So far, no luck in the Google search.
>
> John
>
> "Paul Glavich [MVP - ASP.NET]" <glav@aspalliance.com-NOSPAM> wrote in
> message news:%238FCd77HEHA.3376@TK2MSFTNGP09.phx.gbl...
> > Well not really, but I think you can achieve what you are after by using
> the
> > Aspnet_setreg.exe utility that is described in Knowledge base article
> > KB329290.
> >
> > If you have VS.NET installed, then you can load IE or load up the MSDN
> help
> > and paste this link into the address bar
> > ms-help://MS.MSDNQTR.2003OCT.1033/enu_kbaspnetkb/aspnetkb/329290.htm
> > to get information on the above article, or simply search on microsofts
> > knowledgebase for it. That should do what you need.
> >
> > --
> > - Paul Glavich
> > Microsoft MVP - ASP.NET
> >
> >
> > "WJ" <JWebb@Msn2.Com> wrote in message
> > news:OzRX5AoHEHA.3832@TK2MSFTNGP10.phx.gbl...
> > > .Net Experts,
> > >
> > > Instead of using MS/Data Protection API, I am using my own encryption
> > > library. I need to impersonate a special account (a local Windows 2003
> > Logon
> > > ID) on my IIS6 box for certain sites, the current "web.config" does
not
> > know
> > > how to decrypt the encrypted password in the line below:
> > >
> > > <identity impersonate="true" user="mySpecialAcct"
password="secretPW"/>
> > >
> > > Is there a way to pause my page loader/authentication process until my
> > > decryption code is completed (to un-encrypt the password) ? In other
> word,
> > > when the user punches in the url, MS/IE will prompt him for his
> password,
> > I
> > > like somehow to intercept this process at the server side until the
> > > decryption is completed.
> > >
> > > Thanks
> > >
> > > John
> > >
> > >
> > >
> > >
> > >
> >
> >
>
>

Relevant Pages

  • Re: How to Facilitate and Use Data Protection on DOM (WinCE 6.0)
    ... make sure that your boot registry is set ... In one scenario the Encryption and ... Decryption in my file system filter seems to work fine but the 2nd ...
    (microsoft.public.windowsce.platbuilder)
  • Re: Microsoft credential cache for 802.1x authentication
    ... however it is stored in the registry it has to be ... reversible encryption, not a hash, or it would not be able to use the MS ... > What have other institutions done with 802.1x authentication via ...
    (microsoft.public.internet.radius)
  • Re: Which is more secure RC2 or RC4 ?
    ... in the registry) they are secure enough for your purposes, ... This will IMHO be the only benefit encryption offers ... RC2 is entirely appropriate for this level of security. ... 64 bit ought to be all right too in order to avoid making encryption ...
    (sci.crypt)
  • Re: Zero configuration registry settings
    ... Things like network keys and passwords are, of course, encrypted ... since that encryption would be useless if it worked the same on every ... Export the registry, with no attempt to set up WZC parameters in it, from ... configuration service will provide an automatic binding to the network I ...
    (microsoft.public.windowsce.embedded)
  • Re: Password Protection Strength
    ... > Changes in encryption file properties in Office 2003 and Office 2002 ... >> Suzanne S. Barnhill ... >> Microsoft MVP ...
    (microsoft.public.word.docmanagement)