Can I encrypt the Sitecore Publishing Service connection strings?

Question

Is there a way to encrypt the connection strings of the Sitecore Publishing Service? I don't want the connection strings to stay in clear text on the server, nor leave the system in Sitecore support packages etc.

For the Sitecore CM/CD roles, this can be done easily with aspnet_regiis.exe -pe(f), but as I understand it, the connection strings are stored differently for the Publishing Service.

Answer 1

.Net Core has turned configuration on its head for the better IMO, have a read of this it explains how it works.

The bad news is that encrypting secrets may not be possible as they are handled differently as per this doco. In a project, I am currently working on, a pure ASP.Net Core website, we ended up creating our own secrets provider. The unfortunate bit for you though is whether to use the provider or not is defined in the source code, and it does not seem that there is an option to extend the Publishing Service.

There is hope though, you might be able to use an environment variable, this will not encrypt the value but it won't just be there in a file.

Set SITECORE_Sitecore__Publishing__ConnectionStrings__core=Data Source=.\\SQLSERVER17;Initial Catalog=511108sc823_core;Integrated Security=False;User ID=***;Password=***;MultipleActiveResultSets=True;ConnectRetryCount=15;ConnectRetryInterval=1

See 3.2.2 Custom Configuration Values in the install guide

It would be nice if Sitecore would offer the option to use the Azure Key Vault configuration provider.

Answer 2

How about User Secrets(.Net Core). Read about it here: Safe storage of app secrets in development in ASP.NET Core https://docs.microsoft.com/en-us/aspnet/core/security/app-secrets?view=aspnetcore-3.1&tabs=windows