How do I convert this connection string to use integrated security?

Question

I'm very much learning about SQL as I'm going along. Visual Studio makes it very easy to get the basics done, but now I want to publish a site, and I need some advice with regards to SQL security.

This is my connection string:

<add name="MyConnectionString"
  providerName="System.Data.EntityClient"
  connectionString="metadata=
  res://*/;
  provider=System.Data.SqlClient;
  provider connection string='
  Data Source=localhost;
  Initial Catalog=MyDb;
  Integrated Security=False;
  User Id=MyUser;
  Password=MyPassword;
  MultipleActiveResultSets=True'" />

As you can see, this does not use integrated security and exposes a user name and password in the web.config file. I understand that this is probably not the best solution, but I'm at a loss to what is.

I have 3 questions:

1. Is this an acceptable practice for a production website?
2. How would I convert the connection string to use integrated security?
3. What else would I need to do on the server to ensure integrated security worked?

Thanks in advance.

Answer 1

1. Yes. Integrated security is very convenient from an admin standpoint. It also seems quite secure to me.
2. I'm going to refer you to other, preexisting material on that: http://www.connectionstrings.com/
3. You need to create a Windows-based login inside of SQL Server and add the proper rights to it. The GUI makes this very easy.

Make sure, that the Windows user's password does not expire (enforce password policy = no).