Remove ConnectionString from app.config

Question

Hello everybody,
Is there any way to remove/hide/encrypt the connection details in a connectionString?
My Problem is:
I've got a Windows Forms Application and I want to use OracleMembershipProvider and OracleRoleProvider.
My App.Config looks the following:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<configSections>
</configSections>
<connectionStrings>
<add name="TNTConnectString" connectionString="user id=user;password=pwd;data source=some_connection;" providerName="Oracle.DataAccess.Client" />
</connectionStrings>
<system.web>
<roleManager enabled="true" defaultProvider="MyOracleRoleProvider">
<providers>
<add connectionStringName="TNTConnectString" name="MyOracleRoleProvider" type="Oracle.Web.Security.OracleRoleProvider, Oracle.Web, Version=2.111.6.20, Culture=neutral, PublicKeyToken=89b483f429c47342" applicationName="some_name"/>
</providers>
</roleManager>
<!-- Enable and customize OracleMembershipProvider settings -->
<membership defaultProvider="MyOracleMembershipProvider">
<providers>
<add connectionStringName="TNTConnectString" applicationName="some_name" name="MyOracleMembershipProvider" type="Oracle.Web.Security.OracleMembershipProvider,Oracle.Web, Version=2.111.6.20, Culture=neutral,PublicKeyToken=89b483f429c47342"/>
</providers>
</membership>
</system.web>
</configuration>
Now the problem is that the app.config file has to be copied to every location where I want to use this program, so everybody can read the connection string and connect to DB.
Is there any possibility to add the connection string at runtime? Or any other ways to avoid writing the ConnectionString in plain text to app.config?
Though this is not a special Oracle Problem I hope anybody can help =)
Thanks in advance,
Florian Fanderl

Answer 1

You could try one of two things:
1) Use DPAPI to encrypt the connection string - http://msdn.microsoft.com/en-us/library/ms998280.aspx
- PRO - it's encrypted and can only be unencrypted on this machine
- CON - it's pretty much specific to this machine
- There is a User Key functionality that will allow you to share this same encrypted data between machines, but it was never a necessity for our uses
- At my company, we built a separate utility to generate the encryption string and then paste that string into our app.config programmatically during installation without all of the additional gobbledy-gook (technical term) that the default method noted above uses.
2) put everything except the connection string into your web.config and then dynamically build the connection string at run time within the app code
- PRO - don't have to worry about storing any username or password in a file system text file.
- CON - you pretty much have to hard-code the connection values. If you have complete control over deployment variables, this could be a minimal issue, but still undesirable.
Regards,
Frank