Oracle EF 6 Code first: How to secure the password field in the connection string in app.config - oracle

Question

I am developing an Windows application with Oracle EF 6 Code first. It works fine, however, the password is stored as a plain text in the connection string in app.config:
<connectionStrings>
<add name="OracleDbContext" providerName="Oracle.ManagedDataAccess.Client" connectionString="User Id=UsrName;Password=password;Data Source=ds" />
</connectionStrings>
What is the best practice to secure the password? I tried to load the connection string and provide the password at run time. Then pass the whole connection string to DBContext via constructor:
public class OracleDbContext : DbContext
{
public OracleDbContext(string connectionstring)
:base(connectionstring)
// : base("name=OracleDbContext")
{
}
...
}
}
public OracleDbContext CreateDbContext()
{
ConnectionStringSettings settings = ConfigurationManager.ConnectionStrings["OracleDbContext"];
string connectString = settings.ConnectionString;
OracleConnectionStringBuilder builder = new OracleConnectionStringBuilder(connectString);
if (String.IsNullOrEmpty(builder.Password))
{
builder.Password = "password";
}
return new OracleDbContext(connectString);
}
but, It failed with an error "Unable to complete operation. The supplied SqlConnection does not specify an initial catalog or AttachDBFileName."

Answer 1

In this MSDN article you will find some information about encrypting connection strings inside web.config / app.config.

Answer 2

I use this way to separate the connectionstring for user.config, but this can easy be tweaked for inserting user/pwd in runtime.
<appSettings file="user.config">
<add key="db" value="DATA SOURCE=server:1521/instance;PASSWORD=password;PERSIST SECURITY INFO=True;USER ID=user"/>
public static string CreateEFConnectionString()
{
var connectionString = ConfigurationManager.AppSettings["db"];
var builder =
new EntityConnectionStringBuilder(
"metadata=res://*/EF_Model.csdl|res://*/EF_Model.ssdl|res://*/EF_Model.msl;provider=Oracle.ManagedDataAccess.Client;")
{
ProviderConnectionString = connectionString
};
return builder.ConnectionString;
}
using (var en = new Entities(Dbutils.CreateEFConnectionString()))
{}
.
public Entities() : base("name=Entities")
{
}
public Entities(string connectionstring) : base(connectionstring)
{
this.Configuration.LazyLoadingEnabled = true;
}
protected override void OnModelCreating(DbModelBuilder modelBuilder)
{
throw new UnintentionalCodeFirstException();
}
}