We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool identity and run under the context of that identity using those credentials (username and password), it also then stores the credentials so that when the machine restarts, you don't need to manually re-configure it in order for it to continue using those same credentials.
However, since the credentials are persistent, this means that any user who can access the persistent storage (be it the file system or some other form of storage) could potentially extract the username and password. Is this an security issue? How does IIS resolve this issue? If it only saved a token, which would result from the username and password for authentication, it wouldn't work because you would also be extract the token and use it.