I'm currently writing a portal site for Microsoft Dynamic CRM, the portal works like this:
- Each user has his own account to login to my portal.
- Each user is assigned a seperate CRM credential by admin. Currently, both username and password for CRM site are stored as plaintext (password for the portal itself is properly hashed, salted,... using AspNet Identity Core).
- After logging into my portal, users will be authenticated with CRM site in the background and can start view, add, edit and delete records on CRM site.
- Users can change their own portal password, but CRM credentials are fixed and can only be changed by admin.
Obviously I wouldn't want to store CRM credential in plaintext, but I cannot find any working solution for my problem. I've considered the following choices:
Hash CRM password and store the hash. This does not work because I need the original password to authenticate with CRM site.
Derived a key from user password and encrypt CRM password, then store the encrypted password (password manager style). Does not work because admin won't be able to change CRM password.
Same as 2, but use admin password to derive the encryption key. This also does not work because then I can no longer authenticate users with CRM site.