title: What is the best way to store connection string in .NET DLLs?
body: <p>The application my team is currently developing has a DLL that is used to perform all database access.  The application can not use a trusted connection because the database is behind a firewall and the domain server is not.  So it appears that the connection string needs to have a DB username and password.  The DLL currently has the database connection string hard coded, but I don't want to do this when we launch as the assembly can be disassembled and the username and password would be right there in the open.</p>
  
  <p>One of the requirements is that the password needs to be changed once every few months, so we would need to roll that out to our internal user base.</p>
  
  <p>Is there a way to store the password encrypted in such a way we can easily distribute to the entire user base without storing it in the assembly?</p>
  
  <p>UPDATE: Thanks to everyone who's answered.  I'll try to answer some of the questions back to me...  The data DLL is used by both ASP.NET WebForms and VB.NET WinForms.  I understand that Applications can have their own config files, but I haven't seen anything on config files for DLLs.  Unfortunately, I can't get to the Jon Galloway post at work so I can't judge if that will work.  From a development standpoint, we don't want to use web services inhouse, but may be providing them to third parties sometime next year.  I don't think impersonation will work because we can't authenticate the user through the firewall.  As a user (or former user) can be an attacker, we're keeping it from everyone!</p>