如何在C＃应用程序中保护服务帐户？

Question

I have a service account for my application and in my application work actually as :

private string SA_myapp = "service_account_myapp@domain.com";
private string SA_myapp_pass = "5tr0ngP455w0rd";
private DirectoryEntry LDAP = new DirectoryEntry("LDAP://" + domainName, SA_myapp, SA_myapp_pass);

It's work as well but I believe it's not the good way do to this.

How can I use my service account with a more secured way in my app ?

PS : C# app, Windows, active directory account

Answer 1

You can use DPAPI to secure the password and store it in registry , so essentially when the service loads itself for the first time it reads the value from one registry key ( say pass_clear ) and then when it starts it check for a value in the key pass_clear , if a value is found it reads it and secures it by calling

ProtectedData.Protect( pass_clear , s_aditionalEntropy, DataProtectionScope.CurrentUser );

The encrypted byte[] can then be converted to base64 string and stored in another registry key pass_secure , which can then be used by the application / service as and when it need to bind itself to the LDAP port.

The data protection scope of current user will only allow the service account to decrypt the password and the framework does the key management for you.