I am working on a web based application that will need to store usernames and passwords. Account information will be needed to perform secondary authentication on behalf of users so I can't simply store usernames and passwords using one-way hashing with salt etc.
Assuming that my basic requirement can't change, any suggestions on how to handle the storage of these accounts? Symetric Encryption using the machine key? Using a random key in web.config? Using SQL based encryption?
Why don't you use the builtin MembershipProviders? http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx
The SqlMemebershipProvider has everything you need. There is even a built-in app that comes with .NET that will prep your DB.
Here is the MSDN page on the db prep tool
The best practice here is to not ask for this information until the moment you pass it on to the external provider. Then only keep the external provider's authentication token, such that you only need to ask for credentials again at points where the external resource would require them if the user were accessing it directly.