I'm doing some relatively amateur C# development for a small customer support team and working with the SalesForce API in my application. With SalesForce, login using the API requires you attach a Security Token to the password. Because my users are finicky, it's going to be necessary for (only) the Security Token to be stored in the application database so they aren't needing to enter it every time they use the application.
I'm hoping to get some advice on the best method of keeping this reasonably secure as this is my first venture into any kind of serious security. I've been doing some reading and picked up the AESThenHMAC encryption/decryption method from this post.
My thoughts on the process are as follows:
- On first login to the application, the user is prompted for their username, password and security token.
- The security token is encrypted using the SimpleEncryptWithPassword from above with their password as the 'password' parameter and stored in the database.
- On subsequent logins, the user is prompted for their username and password, the security token is retrieved and decrypted, then the user is logged in using the SalesForce API.
My questions are:
- Does this provide a reasonable level of security for the storage of the Security Token?
- If not, why not and what can/should I do to improve it?
If so, which of the following is the better method of indexing the Security Token by the username in the database?
- Username is Plain Text
- Username is hashed
- Username is encrypted in the same manner as the Security Token
Thanks in advance for any advice/help/input.