在 SQL Server 2008 数据库中存储和使用 Microsoft 用户帐户凭据
为了标题的缘故，我不太确定如何措辞，所以请原谅我。另外，我似乎不知道如何用谷歌搜索这个问题，所以我希望我能找到正确的方向。
我的部分软件（VB.NET 应用程序）需要能够访问/读取/写入共享网络文件夹。我可以选择让用户指定访问所述文件夹可能需要的任何凭据。
我想将这些凭据存储在 SQL Server 数据库中作为配置的一部分（我有一个包含配置的表）。
我担心的是用户帐户的密码将被解密。然而，如果我加密密码，VB.NET 应用程序和/或数据库将无法使用文件 I/O 操作的凭据，除非密码在使用前未加密。
我正在寻求有关如何更好地处理这种情况的建议。
I'm not exactly positive how to word this for the sake of the title so please forgive me. Also I can't seem to figure out how to even google this question, so I'm hoping that I can get a lead in the right direction.
Part of my software(VB.NET App) requires the ability to access/read/write a shared network folder. I have an option for the user to specify any credentials that might be needed to access said folder.
I want to store these credentials given in the SQL Server database as part of the config (I have a table which contains configuration).
My concern is that the password for the user account will be unencrpyted. Yet, if I encrypt the password the VB.NET App And/Or database will be unable to use the credentials for file i/o operations unless the Password is unencrypted before use.
I'm fishing for suggestions on how to better handle this situation.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
SQL Server 本身具有存储 Windows 凭据的方法，请参阅CREATE CREDENTIAL：
但以任何形式将用户凭据存储在应用程序中始终都是一个坏主意。其一，当用户更改密码时，它们就会不同步。其次，冒充用户访问资源永远不是正确的解决方案。正确的解决方案是实际设置组成员身份并正确定义资源的访问控制列表。
访问资源的唯一正确场景是：
SQL Server itself has means to store Windows credentials, see CREATE CREDENTIAL:
But storing user credentials in the application, in any form, is always a bad idea. For one, they go out of sync when the user changes the password. Second, impersonating users to access resources is never the correct solution. The correct solution is to actually set up group membership and properly define access control lists on the resources.
The only correct scenarios for accessing resources are:
我建议在您的应用程序中使用 Windows 身份验证。如果这样做，则可以在共享文件夹和数据库中设置权限，并避免在数据库中存储任何类型的凭据。
I would suggest using Windows authentication in your application. If you do that, then you can set permissions on the shared folder and in the database and avoid storing credentials of any sort in the database.
如果您想以加密方式存储密码，则需要使用自己的加密算法或允许您再次解密密码的算法。有很多方法可以做到这一点，最常见的一种是使用安全词对其进行加密，这样您就可以使用相同的词再次解密。
好吧，可能不是一个真正的单词，而是类似随机字节数组或类似的东西。
You need to use your own encryption algorithm or one that allows you to decrypt the password again if you want to store it encrypted. There are many ways to do this one of the more common is to encrypt them with a safeword so you can use the same word to decrypt again.
Well, probably not a real word but something like a random byte-array or anything similar.