I provide a service in which users can store data, files, etc in an encrypted form. The service that I have built has two applications for the user's password with which they login to my service: 1) authentication and 2) the password is used as the base for the secret encryption key for data they store with my service.
I am integrating with another service whose users need to be able to access my service via SSO, either OAuth2, SAML or some other standard. The obvious problem is that the user's password is eliminated and thus cannot be used as a secret key.
A few questions:
Can the user's password from the parent service be passed to my application allowing for it to be used as the secret key for encryption?
If a secret is randomly generated when the user registers for my service via SSO, can this be stored anywhere securely?
Currently my service employs AES-256 symmetrical encryption. Is there a better encryption scheme for my use case?
Any ideas for a string other than the user's password that could be used as a secret key?