I have a web project where I need to store a username and password in an SQL database. the username/password are for exchange web services.(so it cannot be hashed, I need to be able retrieve a clear text password) Each user of the web page will have to enter their username and password once and this is the information I want to store in SQL database, but in a way so its not possible to decrypt it for others then the user logged in to the web application (due to security concerns) I was thinking I could do this by using the users password for the web application to encrypt and decrypt the password. In this way you can only decrypt the exchange password if you know the users password for the web application. (which is hashed for this web application)
The web application is using forms authentication and the users has the option to "Remember me" so they don't have to sign in every time and here is the problem. I might not get a request with password for every new session. The exchange servers are out of our control, so we cannot use any impersonation, add users with special permission to mailboxes etc. The only thing we know about the exchange server is what we get through the exchange autodiscover service.
The only way I can think of is to create a hash representation of the users password and store it the authentication cookie. Then I can use this hash (plus some salt) to encrypt and decrypt the password for the exchange web services.
Is this a safe way to do it? is there any better way to solve this issue?