Plain text password in Spring Security session
<p>I am working on a Grails application that uses the excellent Spring Security Plugin. The authentication happens through Oracle Access Manager which protects the application URL. So I just use the PreAuth filter and never had to worry about passwords. Until now.</p>

<p>There is another application that we need to integrate with (that manages freezer Samples and need user access management so that user's don't see someone else's samples) and uses LDAP. The said application exposes an API that takes in a username password and returns data based that user's access (there is no on behalf of user feature).</p>

<p><strong><em>The problem is</em></strong> that I need to ask users for their passwords and send plain text password to that service. So hashing and encoding needs to be reversible and I cannot just compare hashcodes. Any suggestions on how to manage this in the best way possible?</p>

<p>I was thinking of using a random salt created on server (and cycle that like every 6 hours), encode the password and set it in a short life cookie, and decode it on the server when making the call to the external service. This way a potential attacker will need data from server memory and the cookies from user's system and I don't store plain text password anywhere. Just a naive attempt. Very open to suggestions.</p>