Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I am experimenting with SharePoint Designer 2010 to create various data sources. When creating database connection using SQL user id and pwd, i get a prompt saying that the user id and pwd will be stored in clear text.

I created a connection to the Northwind database, selected a table and saved the connection. I then created a webpart page, inserted data source and display the data on the web part page.

My questions are-

Which file actually stores the user id and pwd details and where is this file located?

Where are the configured Database connections or rather all the Data sources (database, rest, xml, soap) physically stored?

In Data Sources section in SP Designer I see lists, libraries, and Database Connections. I do not see any library in the sharepoint portal that contains this information.

share|improve this question
add comment

1 Answer 1

The credentials are stored using the Secure Store Service. These are held in the _SecureStoreDB on the database server that is supporting your SharePoint installation. They are not stored in a traditional file (very little about SharePoint configuration is file-based).

The credentials themselves are stored as an "image" datatype in SQL server (in the SSOCredentials table of the above named database). IIRC, this is just a way of it labelling a small binary chunk; but it abstracts the method of encryption that they're using. Obviously, it will have to be a symmetric means.

The data sources are stored using the Business Data Catalog model, which is described in the _BusinsesDataCatalogDB database. There are a handful of linked tables, but going into the details isn't really worthwhile. Your means of interaction with the model should never touch this DB, and should be done either by uploading BDC models as solutions; or through SP Designer as you've been doing.

share|improve this answer
    
I looked up the SecureStoreDB. There is a table with the name SSSCredentials instead of SSOCredentials and it is empty. I wanted to understand how are the credentials stored as plain text and how can it be a potential security risk. The link i am following is office.microsoft.com/en-us/sharepoint-designer-help/… It mentions "SQL authentication saves the user name and password as text in the data connection, any user with permission to open the site in SharePoint Designer 2010 can view these credentials." –  Ron Aug 13 '12 at 8:42
    
Any other hints on this? I am still trying to understand how the connection string is exposed in clear test if it is stored in SecureStore DB. –  Ron Aug 23 '12 at 10:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.