Search code examples
genexus

Hide password in Genexus beforeConnect procedure

I'm using the BeforeConnect option in Genexus. I put this code in a procedure...

&UserID = &websession.Get("db")

//select the Database depending on websession 
Do Case
   Case &UserID = "1" 
        &DataBase  = "CambioDB1" 
   Case &UserID = "2" 
        &DataBase  = "CambioDB2" 
   Otherwise 
        &DataBase  = "CambioDB1" //default database 
EndCase

//Change connection properties 
&dbconn = GetDatastore("Default") 
&dbconn.UserName = 'username' 
&dbconn.UserPassword = 'password'
&dbconn.ConnectionData = "DATABASE=" + &DataBase.Trim() //SQLServer

... set the BeforeConnect property and it works.

But how can I avoid to put the password of the db in the code? I was thinking to use a file to read from, but it would be an unencrypted password anyway.

How can I solve this? Is there a way to manage this or do I have to risk the password in clear text?

Solution

  • Nicola,

    You may use the ConfigurationManager to read a value from the standard config file (client.cfg for Java, web.config for .net).

    &MyPassword = ConfigurationManager.GetValue('MY_PASSWORD')

    Add a value to your configuration file with the password. For example: MY_PASSWORD=my-db-password

    You probably want to save the password encrypted for an extra layer of security. Simple: &EncPass = Encrypt64(&Password, &SysEncKey)

    Stonger encryption: https://wiki.genexus.com/commwiki/servlet/wiki?42682,Symmetric+Stream+Encryption

    &EncPass = &SymmetricStreamCipher.DoEncrypt(symmetricStreamAlgorithm, key, iv, plainText)