Firstly this is not about how to store password for access to the application itself. That is handled using .Net Identity. Authentication is handled using JWT. So it is a web application.
The problem is to be able to store and retrieve passwords as safely as possible for the users of the system.
One user (a company with several employees) may have a number of clients for whom they have access to report, say taxes or VAT using different services. That requires credentials for those services. And it requires that those credentials are stored as safely as at all possible.
Users could do this themselves in password managers, but there is a big risk that either they mess up by not synchronizing changes between employees or they forget to delete credentials when a client is no longer with them.
Further there may be levels of access usually meaning several password manager storage files. Which will increase the mess the user's employees can get themselves into.
I can think of the following requirements
- Passwords are encrypted with public/private key pair
- Passwords are stored in the database as encrypted
- Passwords are never shown in clear text, only copied to clipboard and expires in short time
- Only employees having access to correct private key can decrypt
- When client is deleted all passwords for that client are deleted
- public/private key pair is not stored in database, security handled by access to client machines
Is there anything that I have overlooked or something that could be done in a better way?