I recently had to deal with how to handle passwords. I first looked at using GPG to create the password then Hash+salt (very similar BTW). Then I realized that I had active directory tools available. So that is what I'm doing using AD to hold everything. I figured that if it was good enough for MS I guess it will work for me. You can setup user groups to control access to your app .

Of course I was working with a desktop app and had a MS server available.

Johnf