Database Connection String Visibility

Hi Jason,

well, unfortunately you just hit another special case. We find the password string with a regex, that unfortunately also does not work with "PWD=". However it does work with "Pwd=" or "pwd=". So, if you have the possibility to modify the connection string, this would be the easiest workaround.

Let me know if that works for you.

Thanks,
-Christoph

Hi Christoph,

I just found an example connection string that is in the web.config file with no whitespaces, but the password is not stripped out. Perhaps it is due to the ";enlist=true;" following the password value?

Database=AAMGlobalCatalog;Server=CTNCORDDBD01\CORPDEV;UID=aamgc;PWD=laksjfi333;enlist=true;

Hi Jason,

The password should automatically be stripped out of all connection strings. The reason it does not work in your case might be the fact that you have whitespaces in your connection string between the assignment operators.

If you change
"Password = pw12345"
to
"Password=pw12345"
it should work.

regards,
-Christoph

Hi Jason,

you can create a ticket, but your chances to get this treated as bug are very low. PM will not easily accept this as a bug, it'll be treated as an enhancement and the chances to get this implemented on the current version are low because the next product release has that feature already. Also having the connection string information stored in the DB is not very common either, you are the first customer to complain about this.

I spoke to R&D, a back port of the 5.5 functionality is not possible because the architecture had to be changed in some areas to make this possible in the next release.

I'm with Ryan in terms of your options.

regards,
Günter

I would suggest that you open a support case.

In the meantime, your options are:

1. Enable security of confidential strings.
2. Unplace the ADO sensor (thus ignoring DB calls from your PurePaths)
3. Wait until 5.5 is released. Talk to your Compuware rep to see if you can get a copy of 5.5 sooner versus later.
4. Updated your app to retrieve the connection string from web.config
5. Do nothing

I realize none of these choices are ideal.

Where is the DB connection detailed stored? In the web.config in <connectionStrings> ?

The reason I am asking is because on my .NET application, dynaTrace masks the password in my connection string automatically.

My connection string looks this in dynaTrace...
Below is my web.config

SQL Server 2005 database. Here is an example of what the displayed connection string displays:

Data Source = CTNGESDB; Integrated Security = false; Persist Security Info = false; Database = db123; User ID =uid12345_rw; Password = pw12345

What kind of database? What version? It is unusual to see the user/pass in the connection string in the PurePath details. Without revealing your password, what does the connection string contain?

Hello,

Do you have any ideas on a workaround for this issue that we can use prior to 5.1 being released in the Spring? I need to come up with some method of preventing the database connection string userid/password from showing to any of our end users of dynaTrace without hiding all confidential strings.

Thanks.

Hi Andi

Thanks for the information. One follow up question - is the connection string data (specifically userids/passwords) stored within dynaTrace in clear text, or is it encrypted? Thank you.