Setting up Dapper with Identity Aspnetcore 2.0

Question

Setting up Dapper with Identity Aspnetcore 2.0

asp.net-core asp.net-identity c# dapper encryption

Question

I've found what seems to be a pretty neat little package that lets you use dapper + identity core 2.0. However, since I am very new to core development, I am getting a little confused about something and I'm not sure how to resolve it. The package in question is this: https://github.com/grandchamp/Identity.Dapper

What the package is asking me is to setup some minor configuration and then things should just work. Here are the instructions:

//To configure the DBMS connection, you can add a DapperIdentity and a DapperIdentityCryptography section to your configuration file like this:

"DapperIdentity": {
    "ConnectionString": "Connection string of your database",
    "Username": "user",
    "Password": "123"
},
"DapperIdentityCryptography": {
    "Key": "base64 32 bits key",
    "IV": "base64 16 bits key"
}

What really confuses me is the DapperIdentityCryptography part. Is it expecting me to leave it as it is or is it expecting me to provide some sort of encrypted string. I just don't get it. The other part I'm confused about is leaving the Connection string in a readable format, I have a feeling that I'm supposed to encrypt it, put it in the ConnectionString section and then provide a key to decrypt it?

Bojan

View more on Stack Overflow

Federico Dipuma · Accepted Answer · 9/30/2017 11:02:52 AM

From what I can see at the moment the DapperIdentityCryptography section is only used for decrypting the provided Password inside the DapperIdentity section. This is not very useful, because you are storing both the encrypted password and the encryption key in the same file, which is almost the same of storing the password in plain text.

You may also store the password directly in plain text, and ignore the DapperIdentityCryptography section entirely.

Example:

"DapperIdentity": {
    "ConnectionString": "Server=myServerAddress;Database=myDataBase",
    "Username": "MyUserName",
    "Password": "MyPassword"
}

If, instead, you want to use the cryptography section you need to generate a pair of Key and IV for AES, encrypt your db password with it and then store Key and IV inside your appsettings.json converted into BASE64 strings (or you may use the command line utility dotnet user-secrets in your development machine like the documentation says) and your Db Password into UTF8 string.

Then your appsettings.json may look like this (taken from the sample):

"DapperIdentity": {
    "ConnectionString": "Server=myServerAddress;Database=myDataBase",
    "Username": "MyUserName",
    "Password": "MYUTF8STRINGENCRYPTEDPASSWORD"
},
"DapperIdentityCryptography": {
    "Key": "FrFE/VtQ5pfNhGYVnyf65Sa6j4h6ion3ItkAnqLsnBE=", // this is an example, never use in production
    "IV": "Ig/YU0tgUqI1u2VzWH0plQ==" // this is an example, never use in production
}

Setting up Dapper with Identity Aspnetcore 2.0

Question

Fastest Dapper Plus Extensions

Accepted Answer

Performance

Expression Evaluator