title: where to store the user credentials in an enterprise application(EAI)?
body: <p><strong><em>Background/Context</em></strong></p>
  
  <p>We are developing a <strong>Event Notification Service</strong>. The application at a high level looks like below:
  <img src="https://i.stack.imgur.com/VkRPC.jpg" alt="high level flow"></p>
  
  <p>Our developene scope involves widget and the ENS.</p>
  
  <p>"<strong>ENS</strong>" acts as a central point of collection for certain types of events that are of interest to users.
  Any user who wants to know when these types of events occur registers with ENS, 
  which identifies events in order and matches notifications with subscriptions.</p>
  
  <p>The user who wants to subscibe should be a valid user of the intergrated application(db, sap system etc)</p>
  
  <p>The sequence of events:</p>
  
  <p><img src="https://i.stack.imgur.com/CRpVo.jpg" alt="enter image description here"></p>
  
  <p>Now my question is:</p>
  
  <p>What is the best pracitces in storing the Users db, sap etc credentials. </p>
  
  <p><strong>EDIT</strong>
  How often should the user be authenticated? Should be everytime the messages are delivered?(As @duffymo mentioned, if I use this strategy, it will affect the source system)</p>
  
  <p><strong>Additional Info:</strong> ENS are the web-services. </p>
  
  <p>ENS polls the SAP(and other applications) and this is where the problem is becoming more complex. 
  In SAP there is data-level authorization. So not all users are allowed to see all the events/data. </p>
  
  <p>If the SAP has PUSHed the data, along with the User info who has authorized to see, then no issues at all.</p>
  
  <p>Case 1: Scheduler is initiated by the ENS</p>
  
  <ol>
  <li>User subscribes to a subscription. At the time of subscription, user is checked for his authorization in the SAP system. If OK, then he will be allowed for Subscription.</li>
  <li>The scheduler runs at the scheduled time.</li>
  <li>The scheduler identifies the users who are subscribed.</li>
  <li>The scheduler uses the stored credentials of the users(stroed in ENS) to POLL if the event occured.</li>
  <li>Notify users if there are changes. </li>
  </ol>
  
  <p>Disadvs here:</p>
  
  <ul>
  <li>User credentials are stored somewhere
  external - Security team might not
  accept it</li>
  <li>Reduntant hits if more than one user
  is subscribed for the same piece of
  information</li>
  </ul>
  
  <p>Case 2: Scheduler is intitated by the WIDGET. User creds will be stored in the users local machine only.
  Diadv: </p>
  
  <ul>
  <li>If the subscription is daily, and if
  the user system/widget is not up. The
  user might miss the notifications
  that happened on say, weekends.</li>
  <li>Reduntant hits to the server if more
  than one user is subscribed for the
  same piece of information.</li>
  </ul>