如何在c＃Web应用程序/服务中保护敏感密码？

Question

I'm writing a service that allows users on my corporate domain to perform limited active directory operations. These users don't have permissions to AD themselves but the site authenticates as a shared user that can do things like unlock an account (for example).

The password in my code is currently in plaintext

Is there a recommended method out there for me to protect this password? Obviously someone would have to decompile the website binaries to get access to it, but I don't feel like that's enough protection.

For background i'm using the newer System.DirectoryServices.AccountManagement methods in C# for doing this, so i have:

PrincipalContext pc = new PrincipalContext(ContextType.Domain, "MYDOMAIN", "theuser", "thepassword");

Any tips appreciated! Otherwise i might just resort to obfuscation, encrypting it and employing several badger-warren-like classes to decrypt the values

Answer 1

I think the best way would be to have the application pool identity have enough permissions to do the necessary work within Active Directory. That would allow the web application to run with without the need of a hard coded username and password. You may need help from a sysadmin to get this setup.

Remember, obfuscation only works so well. Obfuscated code does have to be de-obfuscated before executing so the processor can understand it. If someone is determined, this can be defeated. But if that is happening, you probably have more than this as a security issue.

And lastly, the user you connecting to active directory with should have the least amount of access possible to mitigate any possible damage in the event the username and password is discovered.