Configure, Store, And Read Secure Store Credentials Within SharePoint - Part Two

In the first part of the series we figured out how to configure and store the credentials within the Share Point Secure Store Service. There would be scenarios where we have to read the credentials from within the code to establish a connection with external systems via BCS. Though there are multiple ways to store credentials within Share Point, the most secure way is to use the native Secure Store Service.

Reading from Secure Store Service

Currently I have created a Secure Store Target Application ‘BCS’ where I have stored the credentials to connect to an external system. Now, say I want to read them from my code. Let’s see how we can do that.

For the demo I have created a Windows form application. Clicking on the Retrieve button should fetch me the Credentials.

What dll references should we add

using Microsoft.SharePoint.Administration;
using Microsoft.Office.SecureStoreService.Server;
using Microsoft.BusinessData.Infrastructure.SecureStore;
using System.Security;
using System.Runtime.InteropServices;

Note: You can get all other dlls except Microsoft.Office.SecureStoreService.Server is present in the Assemblies tab of Visual Studio. Secure Store Service dll is present under c:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.SecureStoreService.

Now let's jump into the code. 

On clickng  of the Retrieve Button I have placed the following code in the button click event handler.

private void Retrieve_Click(object sender, EventArgs e)
{
    // Get the default Secure Store Service provider.
    ISecureStoreProvider provider = SecureStoreProviderFactory.Create();
    if (provider == null)
    {
        throw new InvalidOperationException("Unable to get an ISecureStoreProvider");
    }
    ISecureStoreServiceContextproviderContext = provider as ISecureStoreServiceContext;
    providerContext.Context = SPServiceContext.GetContext(GetCentralAdminSite());
    // Create the variables to hold the credentials.
    string userName = null;
    string password = null;
    string appId = "BCS";
    try
    {
        using(SecureStoreCredentialCollectioncreds = provider.GetCredentials(appId))
        {
            if (creds != null)
            {
                foreach(SecureStoreCredential cred in creds)
                {
                    if (cred == null)
                    {
                        continue;
                    }
                    switch (cred.CredentialType)
                    {
                        caseSecureStoreCredentialType.WindowsUserName: if (userName == null)
                            {
                                userName = GetStringFromSecureString(cred.Credential);
                            }
                        break;
                        caseSecureStoreCredentialType.WindowsPassword: if (password == null)
                            {
                                password = GetStringFromSecureString(cred.Credential);
                            }
                        break;
                    }
                }
            }
        }
        if (userName == null || password == null)
        {
            throw new InvalidOperationException("Unable to get the credentials");
        }
        UserName.Text = userName;
        Password.Text = password;
    }
    catch (SecureStoreException ex)
    {
        throw;
    }
}
private static string GetStringFromSecureString(SecureStringsecStr)
{
    if (secStr == null)
    {
        return null;
    }
    IntPtrpPlainText = IntPtr.Zero;
    try
    {
        pPlainText = Marshal.SecureStringToBSTR(secStr);
        returnMarshal.PtrToStringBSTR(pPlainText);
    }
    finally
    {
        if (pPlainText != IntPtr.Zero)
        {
            Marshal.FreeBSTR(pPlainText);
        }
    }
}
public static SPSiteGetCentralAdminSite()
{
    SPAdministrationWebApplicationadminWebApp = SPAdministrationWebApplication.Local;
    if (adminWebApp == null)
    {
        throw new InvalidProgramException("Unable to get the admin web app");
    }
    SPSiteadminSite = null;
    Uri adminSiteUri = adminWebApp.GetResponseUri(SPUrlZone.Default);
    if (adminSiteUri != null)
    {
        adminSite = adminWebApp.Sites[adminSiteUri.AbsoluteUri];
    }
    else
    {
        throw new InvalidProgramException("Unable to get Central Admin Site.");
    }
    returnadminSite;
}

The above code contains two main functions.

1. GetCentralAdminSite – This function is used to get an instance of the Central Administration. It returs the SPSite of the CA site.
   
   
2. GetStringFromSecureString – The credentials are encrypted using a passphrase which we create while Secure Store Service Application creation. The Encrypted password is decrypted and returned back as plain text.

Here the target application ID is ‘’BCS’ .The flow of the code is as below:

• Get the Central Admin site object,
  

  providerContext.Context = SPServiceContext.GetContext(GetCentralAdminSite());

• Pass in the Target application id and get the Secure store credentials which is a key value pair.
  

  SecureStoreCredentialCollectioncreds = provider.GetCredentials(appId)

• Pass the Secure store id to the decryption function to get back plain text.
  

  userName = GetStringFromSecureString(cred.Credential);
  password = GetStringFromSecureString(cred.Credential);

  Final Output
  
  

Reference

• Get User Credentials Using the Default Secure Store Provider