Plain text password in Spring Security session - security

Question

I am working on a Grails application that uses the excellent Spring Security Plugin. The authentication happens through Oracle Access Manager which protects the application URL. So I just use the PreAuth filter and never had to worry about passwords. Until now.
There is another application that we need to integrate with (that manages freezer Samples and need user access management so that user's don't see someone else's samples) and uses LDAP. The said application exposes an API that takes in a username password and returns data based that user's access (there is no on behalf of user feature).
The problem is that I need to ask users for their passwords and send plain text password to that service. So hashing and encoding needs to be reversible and I cannot just compare hashcodes. Any suggestions on how to manage this in the best way possible?
I was thinking of using a random salt created on server (and cycle that like every 6 hours), encode the password and set it in a short life cookie, and decode it on the server when making the call to the external service. This way a potential attacker will need data from server memory and the cookies from user's system and I don't store plain text password anywhere. Just a naive attempt. Very open to suggestions.

Answer 1

So I hacked one of my apps to work like this:
In the User class: (Spring Security User.groovy)
static transients = ['springSecurityService', 'rawPassword']
//To bypass facebook users who log in via facebook
//we will back up original hashed password string
//log them in then save old password has by calling user.rawPassword=oldHash
//this will update underlying password with string hash value
void setRawPassword(String p) {
password=p
}
Then in the relevant service
//Get old password hash
def oldPassword=user?.password
String authPassword
if (oldPassword) {
def uid = user.password + new UID().toString() + prng.nextLong() + System.currentTimeMillis()
MessageDigest digest = MessageDigest.getInstance("SHA-256");
byte[] hash = digest.digest(uid.getBytes("UTF-8"));
def token1 = hash.encodeBase64()
user.password = token1
//Generate a random password
authPassword = token1
//Update user Password to be random Password
UsernamePasswordAuthenticationToken uat1 = new UsernamePasswordAuthenticationToken(user.username, authPassword, null)
uat1.setDetails(user)
SecurityContext context = SecurityContextHolder.getContext()
//Re-setAuthentication of springSecurity using new Password
context.setAuthentication(uat1)
if (oldPassword) {
//Now we are authenticated let's set back the original Hash as the hash we collected in oldPassword
//just before doing the hack
user.rawPassword = oldPassword
user.save(flush: true)
}
springSecurityService.reauthenticate user.username
}
This is rather an ugly hack to authenticate as a user without changing their set password (in the end) during process changed and changed back again..
I am not recommending it but it may be an easier option than what you have outlined