I am developing .NET Application. I have cloud SAP application which contains documents. Using Cloud SAP, i am fetching the data as an xml and storing the data in to MySQL database. for this, i am developing one page code. The question is, i am maintaining SAP credentials and SQL server credentials in same page. It means, directly i am mentioning the username and password. Due to safety and security, i want to avoid to use direct credential in my code. I want to use secured credentials either encrypt or some other secured logic should apply here... How to do this...?

For SQL Server I would try to switch to using a trusted connection. (IE give the user the app pool is running under just the access needed for the database) I would look at using Oauth tokens for talking with the SAP cloud https://www.itsfullofstars.de/2020/05/how-to-obtain-an-oauth-2-0-token-in-sap-cloud-platform/

How to avoid to give direct credential in .NET source code

Accepted answer

Ken Tucker 5,846 Reputation points

2022-01-04T11:02:49.467+00:00

For SQL Server I would try to switch to using a trusted connection. (IE give the user the app pool is running under just the access needed for the database)

I would look at using Oauth tokens for talking with the SAP cloud

https://www.itsfullofstars.de/2020/05/how-to-obtain-an-oauth-2-0-token-in-sap-cloud-platform/
Please sign in to rate this answer.
Gani_tpt 1,706 Reputation points

2022-01-04T11:10:46.94+00:00

can you pls. give more clarity on this.

below is my sample code in win C#.

string uri = "";
/* SAP CREDENTIALS /
string userName = "TZ.RAMEY";
string password = "FORTEST";
/ SAP CREDENTIALS /
string method = "GET";
/ SQL Connection String */
var Newcon = new SqlConnection(@"data source=SRVRZX2; user id=*****; password=****; database=NEUT;");
/* SQL Connection String */

Gani_tpt 1,706 Reputation points

2022-01-04T16:38:12.407+00:00

is there any place to hide password and encrypt/decrypt method..?

P a u l 10,406 Reputation points

2022-01-04T17:00:23.187+00:00

Have you looked at the user secrets CLI? https://learn.microsoft.com/en-us/aspnet/core/security/app-secrets?view=aspnetcore-6.0&tabs=windows

I've not used it myself - I store sensitive details in my deployment system & they're injected into the appsettings.json of my projects during deployment, but the above should be a good place to start.

AgaveJoe 26,161 Reputation points

2022-01-04T18:22:18.353+00:00

Also, encryption and decryption is openly published in the official C# documentation.

Encrypting data

Gani_tpt 1,706 Reputation points

2022-01-04T23:57:49.23+00:00

Shall we keep maintain credential seperate from the source code.?
Sign in to comment

Share via

How to avoid to give direct credential in .NET source code

0 additional answers