My employer has a system that clinicians use to capture video data for patient bookings. This comprises two applications running on Windows:
- A local service (C#).
Both applications need to access our API over the internet.
Users must log into our API with their own account and password but they do so from the GUI application that runs on a computer with shared login credentials (shared between all clinicians at a site).
The two apps currently communicate over RPC (I plan to switch this to a local REST service in future).
What is a secure way to authenticate with our API from the C# service, given I only want the user to log in once, using the GUI application?
Can those authentication credentials be securely stored for use later by the C# service on a shared-access computer?
The GUI application is used to login (authenticating with our internet API) and get the list of available patient bookings for the user (over same secure API). The user then selects one of the bookings and captures some video data for it. Once video capture has completed, the GUI app hands the data over to the C# service.
The C# service's job is to run continuously in the background and perform time-consuming processing work on captured video data. Once that processing has been completed, some results data needs to be uploaded to our internet API.
We don't want the user to have to wait until this post-processing has completed (it may take 10 minutes or so) so we want them to be free to close down the GUI application and still have uploads occur in the background while the computer is running.
I would like to be able to restart the computer and have the C# service (which runs at startup) pick up where it left off with processing and uploading data. For this, I'd need to securely store the credentials of the user who performed the capture so they can be read back.
I've considered passing the credentials in plaintext over RPC when a user logs in successfully so both app are aware of them. This answer indicates there is no need for interprocess encryption on the same machine, but I'm not sure if that is reasonable given the user account used to access the computer is shared. I'm also not sure if it's possible to securely encrypt the credentials for use later without re-authenticating to unlock them in some way. (Our API password is not tied in any way to the password used to log into Windows and we don't want to integrate those as we may move away from Windows in the future).
Any help appreciated, thanks