views:

152

answers:

3

I am working on a web based application that will need to store usernames and passwords. Account information will be needed to perform secondary authentication on behalf of users so I can't simply store usernames and passwords using one-way hashing with salt etc.

Assuming that my basic requirement can't change, any suggestions on how to handle the storage of these accounts? Symetric Encryption using the machine key? Using a random key in web.config? Using SQL based encryption?

+4  A: 

Why don't you use the builtin MembershipProviders? http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx

Daniel A. White
My understanding of the asp.net membership provider is that it provides a method of authenticating my my web application. I need to store accounts / password that I can use to authenticate against using a secondary API that I don't control. I need to replay the account / password. Can I do that?
Andrew Robinson
OK, This is what I was looking for:http://msdn.microsoft.com/en-us/library/2x0c6sfa.aspx
Andrew Robinson
+1  A: 

The SqlMemebershipProvider has everything you need. There is even a built-in app that comes with .NET that will prep your DB.

Here is the MSDN page on the db prep tool

mjmarsh
+1  A: 

The best practice here is to not ask for this information until the moment you pass it on to the external provider. Then only keep the external provider's authentication token, such that you only need to ask for credentials again at points where the external resource would require them if the user were accessing it directly.

Joel Coehoorn
Ideally this is what I would like to do but I don't think the API that I am working with supports this. I will need to pass the account / password for all opperations.
Andrew Robinson