title: How to use encrypted connection string on app.config with Dataset.xsd generated by Wizard on Windows Form
body: <p>I'm developing an MDI application with <strong>Visual Studio 2013 (.NET 4.5)</strong> and <strong>Oracle Developer Tools</strong> latest release. I need to create a main form that then will be the container for many different forms, each of which will be a different application.</p>
  
  <p>The application have to connect to different Oracle databases and now I'm trying to set the main form to keep all the connection strings encrypted and possibly on a separate file. For now the connection string is only one.</p>
  
  <p>To encrypt the connection string I've used the <code>aspnet_regiis</code> method described on those articles:</p>
  
  <ul>
  <li><a href="http://digantakumar.com/2010/12/20/web-config-encryptiondecryption-in-framework-4-0/" rel="nofollow noreferrer">Web Config Encryption/Decryption in Framework 4.0</a></li>
  <li><a href="http://msdn.microsoft.com/en-us/library/53tyfkaw(v=vs.100).aspx" rel="nofollow noreferrer">Encrypting Configuration Information Using Protected Configuration</a></li>
  </ul>
  
  <p>To sum up:</p>
  
  <p>I added to my app.config the <code>&lt;configProtectedData&gt;</code> section where I defined my own RSA provider and my key container because I need to export and import the keys on several machines. Then I created the key container and used it with the <code>aspnet_regiis</code> tool to encrypt the <code>&lt;connectionStrings&gt;</code> section.</p>
  
  <p>I also set the <code>&lt;oracle.manageddataaccess.client&gt;</code> section for the <code>TNS_ADMIN</code> variable to use my own <strong>Oracle Instant Client</strong> and my custom <code>tnsnames.ora</code> file. This will help to avoid problems with different machine OSes and Oracle client versions and configurations.</p>
  
  <p>So, now this is how my final <strong>app.config</strong> file should be:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt;
  &lt;configuration&gt;
    &lt;configSections&gt;
    &lt;/configSections&gt;
    &lt;oracle.manageddataaccess.client&gt;
      &lt;version number="*"&gt;
        &lt;settings&gt;
          &lt;setting name="TNS_ADMIN" value="D:\VSProjects\Visual Studio 2013\Projects\MDITest\MDITest\"/&gt;
        &lt;/settings&gt;
      &lt;/version&gt;
    &lt;/oracle.manageddataaccess.client&gt;
    &lt;configProtectedData&gt;
      &lt;providers&gt;
        &lt;add name="OracleDeveloperRSAProtectedConfigurationProvider"
      type="System.Configuration.RsaProtectedConfigurationProvider,System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
      keyContainerName="OracleDeveloperDbKeys"
      description="Uses RsaCryptoServiceProvider to encrypt and decrypt" /&gt;
      &lt;/providers&gt;
    &lt;/configProtectedData&gt;
    &lt;connectionStrings configProtectionProvider="OracleDeveloperRSAProtectedConfigurationProvider"&gt;
      &lt;EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element"
        xmlns="http://www.w3.org/2001/04/xmlenc#"&gt;
        &lt;EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /&gt;
        &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#"&gt;
            &lt;EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" /&gt;
            &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;KeyName&gt;Rsa Key&lt;/KeyName&gt;
            &lt;/KeyInfo&gt;
            &lt;CipherData&gt;
              &lt;CipherValue&gt;ZuB8jsXnXR/6Ww47R4Oc/ksSgHsrRuuOkNypbsdfm1ASDlvdsklsgfhtrwaADFHrywswvfhgnjlsGHSDJKFEROvfsd/TV+LKlysPkccEXmJFCcFZ7S9geSInPBaNvYGweR9FcTK1HVcrYMaddgfBK6lpSTTw6cdMRIOcw0Ib//oYPr34=&lt;/CipherValue&gt;
            &lt;/CipherData&gt;
          &lt;/EncryptedKey&gt;
        &lt;/KeyInfo&gt;
        &lt;CipherData&gt;
          &lt;CipherValue&gt;01old8NrGlRAOLdfdtXUKYuBkZPY5XbWMI/j22Hnm8U=&lt;/CipherValue&gt;
        &lt;/CipherData&gt;
      &lt;/EncryptedData&gt;
    &lt;/connectionStrings&gt;
    &lt;startup&gt;
      &lt;supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" /&gt;
    &lt;/startup&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>Now I need to use the Data Source Configuration Wizard to set up the Oracle Dataset and then be able to drag and drop tables from DataSource Explorer to the forms that automatically creates navigation buttons and keep relations between tables and so on.</p>
  
  <p><img src="https://i.stack.imgur.com/2DmTR.png" alt="Data source configuration Wizard"></p>
  
  <p>But when I finish the configuration with the Wizard on a new application with the original <code>app.config</code>, it asks me to create a ConnectionString and stores it inside the <code>app.config</code> and then a copy is also placed inside the <code>Settings.settings</code> file, <strong>obviously in plain text</strong>.</p>
  
  <p>If I do the above procedure to encrypt the <code>&lt;connectionStrings&gt;</code> section in the original <code>app.config</code>, then the <code>DataSet.xsd</code> <strong>works only if the</strong> <code>ConnectionString</code> <strong>setting is present inside the</strong> <code>Settings.settings</code>. It doesn't use the <code>app.config</code> parameter.</p>
  
  <p>I tried to open the <code>DataSet.Designer.cs</code> file but there're <code>Connection</code> and <code>ConnectionString</code> parameters specified for each <code>TableAdapter</code> object and since there're many tables in my dataset, I'd like to avoid a find/replace approach... Also because if I need to make some changes to the dataset, then the <code>DataSet.xsd</code> file will probably be overwritten and so all the edits will be lost.</p>
  
  <p><strong>I want to know which is the best way to replace the connection string and use the encrypted one instead.</strong></p>
  
  <p>At last I'd also like to know if I can move my <code>&lt;connectionStrings&gt;</code> section to a different .config file while mantaining the encryption.</p>
  
  <p><strong>-- EDIT --</strong></p>
  
  <p>I've made some more tests recreating a new application project and Visual Studio seems smarter than I thought!</p>
  
  <p>I added the first connection string to a blank <code>app.config</code> after using the Wizard to setup a new Data source. Then I edited the <code>app.config</code> and moved the <code>&lt;connectionStrings&gt;</code> section to a new <code>connections.config</code> file. I applied the <code>aspnet_regiis</code> method to encrypt the  section and everything worked. But, since I could still can see the connection string in plain text inside the <code>Settings.settings</code> I decided to change the <code>&lt;CipherData&gt;</code> string to see if the application would throw an error or if it would work without problems. Very simply, if the application throws an error, then it's using the encrypted connection string (what I want - correct), otherwise it is using the plain text connection string on <code>Settings.settings</code> (what I don't want - not correct). Surprisingly the application throwed an exception!</p>
  
  <p>It seems that the <code>Settings.settings</code> panel always shows the plain text connection strings just because it reads the app.config (and so connections.config too) and then apply an "on the fly" decryption. <strong>So that panel can be considered just like a simple view of the app.config that shows some parameters, even if they are encrypted.</strong></p>
  
  <p>In addition to that, I added a second Data source with another connection, again using the Wizard. The new connection was automatically added to the <code>connections.config</code> encrypted! I noticed it because the <code>&lt;CipherData&gt;</code> string was changed. Also the new connection was visible in plain text inside the <code>Settings.settings</code>. So I redid the same test as before by changing the string and the application throwed again an error.</p>
  
  <p>So, finally, <strong>there's no need to re-encrypt the app.config file each time you add a new connection because it is automatically done!</strong> Great!</p>