My organization has an in-house user authentication system shared between a very large number of internal systems.
One of these systems needs to retrieve information from the logged in user's exchange account. Logged in here means logged into the system - the client is not necessarily a windows machine on our domain. However, the mapping to a valid windows user is known.
I'm trying to find a secure way to handle this without requiring the user to authenticate manually with both sets of credentials. The two suggestions are:
- Store the users' plain-text exchange password in either the client or server of the service used to access exchange. Obviously if that service were to be compromised, this would result in the passwords being compromised.
- Use an account allowed to impersonate all users. If this were compromised, then all exchange data would be compromised.
Neither is exactly appealing. Is there any way to pass our existing token to exchange and have an exchange plugin or service call to verify it?