java - where to store the user credentials in an enterprise application(EAI)? -

background/context

we developing event notification service. application @ high level looks below:

our developene scope involves widget , ens.

"ens" acts central point of collection types of events of interest users. user wants know when these types of events occur registers ens, identifies events in order , matches notifications subscriptions.

the user wants subscibe should valid user of intergrated application(db, sap system etc)

the sequence of events:

now question is:

what best pracitces in storing users db, sap etc credentials.

edit how should user authenticated? should everytime messages delivered?(as @duffymo mentioned, if use strategy, affect source system)

additional info: ens web-services.

ens polls sap(and other applications) , problem becoming more complex. in sap there data-level authorization. not users allowed see events/data.

if sap has pushed data, along user info has authorized see, no issues @ all.

case 1: scheduler initiated ens

1. user subscribes subscription. @ time of subscription, user checked authorization in sap system. if ok, allowed subscription.
2. the scheduler runs @ scheduled time.
3. the scheduler identifies users subscribed.
4. the scheduler uses stored credentials of users(stroed in ens) poll if event occured.
5. notify users if there changes.

disadvs here:

• user credentials stored somewhere external - security team might not accept it
• reduntant hits if more 1 user subscribed same piece of information

case 2: scheduler intitated widget. user creds stored in users local machine only. diadv:

• if subscription daily, , if user system/widget not up. user might miss notifications happened on say, weekends.
• reduntant hits server if more 1 user subscribed same piece of information.

usually it's application that's given credentials database, sap, etc. individual users have credentials stored in ldap or database; authentication , authorization handled cross-cutting concern application, eai server, or appliance siteminder.

incoming requests intercepted , checked authorization tokens. if token doesn't appear, check authentication , authorization. if allowed, create authorization token , cache it.

this usual scenario web applications. event notification situation yours it's more complicated. you'll have check authorization when user subscribes. should notify them right away if user unauthorized, because don't want have check credentials every time publish. there have association between user, subscribed event, , authorization credential.

i see 1 problem.

you may broadcast events unauthorized user if subscribe event, find out authorized, receive first broadcast, , become unauthorized reason. suggests you'll have check credentials each , every time broadcast subscribers. become onerous , slow app down.

have @ standards saml see if can you.

the caching issue hinges on comparison between time between events , between authorization changes. if time between events long compared authorization changes have check each time, because have no way know if authorization has been rescinded since last event.