The problem: some environments need to use plain text credentials or long-lived tokens in order to unlock a specific functionality. Examples include
- third party legacy services which need a login/password for authentication (they do not support oAuth, OpenID, short-term tokens or similar solutions and cannot be adapted)
- unlocking of an encrypted vault which require the input of a password at application start
There is a way to programmatically trigger these services but this requires to present plaintext credentials.
What is the current consensual position on solutions for the storage of such credentials?
One solution is to encrypt them, with more or less elaborate ways to disconnect the encryption key from the code. I do not want the teams in charge of this part of the project to invent their own solution as it is likely to be weak. I would appreciate any pointers if there is something tangible on that subject (I did not fond anything, OWASP does not even try to hint that this is acceptable, which is understandable but not very useful).
I also saw that HSMs are suggested but I fail to understand how they facilitate the recovery of the key/credentials (I understand their value as secure data stores).