title: Impersonation in web.config
body: <p>Ive been asked to fix a security issue for a webbapplication. The issue is that the webbapplication uses impersonation in the web config to log on to a domain. If the password is incorrect an exception is throwned in wich the web config credentials is shown on the screen. </p>
  
  <p>Its not clear why the webbapp logs into the domain, but i need to </p>
  
  <ol>
  <li>Make sure the credentials info is not shown in the exception.</li>
  <li>Get the password from a database instead of storing it in web config. </li>
  <li>Keep the impersonation function intact.</li>
  </ol>
  
  <p>&lt; system.web></p>
  
  <p>&lt;  identity impersonate="true" userName="Domain\AdminUser" password="1234ABCD">    </p>
  
  <p>&lt;  /system.web></p>