Creating Secure Store Application and Retrieving Credentials From the Secure Store Application

A Secure store application is used to store credentials for fetching data from an external system.

For example If we want to fetch data from a web service into a SharePoint project and credentials are required to access the web service then instead of hard-coding the credentials in the SharePoint project we can securely store the credentials in a secure store application.

How to store credentials in a secure store application

1. Go to the Central Administration site.
   
2. Click on Manage Service Applications under the Application Management group.
   
   
   
   
3. Click on Secure Store application.
   
   
   
   
4. Create a new Target Application to store the user credentials. Click on the New button in the ribbon.
   
   
   
   
5. It will open a Create New Secure Store Application page. Specify the following details:
   
   Application Id: Secure Store Application ID that will be unique to access to your credentials.
   Display Name: Display Name of the application.
   Contact Email: Valid Email address
   
   Target Application Type: group
   
   
   
   
6. Click on "Next".
   
7. In the next page specify the credential fields for your secure store application.
   
   For example Field Name Field Type Marked
   
   UserName Windows User Name No
   
   Password Windows Password Yes
   
   
   
   
8. Click on "Next". In next page specify the Target Application’s membership settings:
   Configure the Target Application Administrators who will have permissions to manage the Target application settings.
   
   Configure the members that will access this application and retrieve the credentials to connect with the external system.
   
   
   
   
9. Click on Ok. It will save the Target Applications Settings.
   
10. Now select the Target Application Id and in the ribbon click on the Set button in the Credentials group.
    
    
    
    
11. It will open a Set Credentials for Secure Store Target Application dialog. Specify the Username and Password for the Windows domain user account that you want to use.
    
    
    
    
12. Click on Ok. It will save the credentials. The Target Secure Store application has been successfully created.

How to access these credentials from Secure Store Application

1. Open a Visual Studio and create a New Empty SharePoint Project.
2. Create it as a Farm Solution.
3. Add the references of following DLLs:
   Microsoft.BusinessData.dll
   Microsoft.Office.SecureStoreService.dll
   
   
   
   
4. Add the following using statements:
   

   using Microsoft.SharePoint.Administration;
   using Microsoft.BusinessData.Infrastructure.SecureStore;
   using System.Diagnostics;
   using System.Security;
   using System.Runtime.InteropServices;

5. Add a class with the name Credentials as follows:
   

   public class Credentials
   {
       private string _userName;
       public string UserName
       {
           get { return _userName; }
           set { _userName = value; }
       }
   
       private string _password;
       public string Password
       {
           get { return _password; }
           set { _password = value; }
       }
   
       public Credentials(string username, string password)
       {
           _userName = username;
           _password = password;
       }
   
       /// <summary>
       ///  Retrieve credential information of a given Secure Store Target Application Id from the Secure Store.
       /// </summary>
       /// <param name="strTargetAppID"></param>
       /// <returns>Credentials Object</returns>
       public static Credentials GetCredentials(string strTargetAppID)
       {
           Credentials objUserCredentials = null;
           SPSecurity.RunWithElevatedPrivileges(delegate()
           {
   
               // Get the default Secure Store Service provider.
               ISecureStoreProvider objSecureStoreProvider = SecureStoreProviderFactory.Create();
               if (objSecureStoreProvider == null)
               {
                   //Throw an InvalidOperationException exception
                   throw new InvalidOperationException("Unable to get an ISecureStoreProvider");
               }
   
   
               ISecureStoreServiceContext objProviderContext = objSecureStoreProvider as ISecureStoreServiceContext;
               objProviderContext.Context = SPServiceContext.GetContext(GetCentralAdminSite());
   
               // variables to hold the credentials.
               string sUserName = string.Empty;
               string sPassword = string.Empty;
   
               // Specify a valid target application ID for the Secure Store.
               string sApplId = strTargetAppID;
   
               try
               {
                   //looking for the first user name, password credentials in the collection.
                   using (SecureStoreCredentialCollection objSecureStoreCredentials = objSecureStoreProvider.GetCredentials(sApplId))
                   {
   
                       Debug.Assert(objSecureStoreCredentials != null);
   
                       if (objSecureStoreCredentials != null)
                       {
                           foreach (SecureStoreCredential cred in objSecureStoreCredentials)
                           {
                               if (cred == null)
                               {
   
                                   continue;
                               }
   
                               switch (cred.CredentialType)
                               {
                                   case SecureStoreCredentialType.WindowsUserName:
                                   if (string.IsNullOrEmpty(sUserName))
                                   {
                                       sUserName = GetStringFromSecureString(cred.Credential);
                                   }
                                   break;
   
                                   case SecureStoreCredentialType.WindowsPassword:
                                   if (string.IsNullOrEmpty(sPassword))
                                   {
                                       sPassword = GetStringFromSecureString(cred.Credential);
                                   }
                                   break;
   
                               }
                           }
                       }
                   }
   
                   //Checking whether required credentials are found
                   if (string.IsNullOrEmpty(sUserName) || string.IsNullOrEmpty(sPassword))
                   {
                       objUserCredentials = null;
                   }
                   else
                   {
                       objUserCredentials = new Credentials(sUserName, sPassword);
                   }
   
   
               }
               catch (SecureStoreException ex)
               {
                   objUserCredentials = null;
               }
           });
           return objUserCredentials;
       }
   
       /// <summary>
       /// This method Converts a secured sting into plain string
       /// </summary>
       /// <param name="objSecureString"></param>
       /// <returns>string</returns>
       private static string GetStringFromSecureString(SecureString objSecureString)
       {
           if (objSecureString == null)
           {
               return null;
           }
   
           IntPtr pPlainText = IntPtr.Zero;
           try
           {
               pPlainText = Marshal.SecureStringToBSTR(objSecureString);
               return Marshal.PtrToStringBSTR(pPlainText);
           }
           finally
           {
               if (pPlainText != IntPtr.Zero)
               {
                   Marshal.FreeBSTR(pPlainText);
               }
           }
       }
   
       /// <summary>
       /// This method retrieves the Central Administration site. This is used by the GetCredentials method to set the ProviderContext.
       /// </summary>
       /// <returns>SPSite</returns>
       private static SPSite GetCentralAdminSite()
       {
           SPAdministrationWebApplication objAdminWebApp = SPAdministrationWebApplication.Local;
           if (objAdminWebApp == null)
           {
               throw new InvalidProgramException("Unable to get the admin web app");
           }
   
           SPSite objAdminSite = null;
           Uri objAdminSiteUri = objAdminWebApp.GetResponseUri(SPUrlZone.Default);
           if (objAdminSiteUri != null)
           {
               objAdminSite = objAdminWebApp.Sites[objAdminSiteUri.AbsoluteUri];
   
           }
           else
           {
               throw new InvalidProgramException("Unable to get Central Admin Site.");
           }
   
           return objAdminSite;
       }
   }

6. Build the Solution.
   
7. Use this class and methods to read the credentials from the Secure Store Application. This class will connect to the secure store application and read the required credentials. If the User context in which the code is running is not a member of the Target Application Members Group, it will throw an exception.

I hope this will help you!