How do you ensure that applications using your domain credentials for login don't store your password?

There are several applications that use your domain credentials for login. Eg: Custom Corporate apps. How do you ensure that such applications don't store your password?

The reason I am asking this is开发者_运维知识库: If you are designing an app which does the same thing, how do you convince the user that your app can be trusted not to store the password?

If you really want the user to be sure your app is not keeping their password, don't use their password.

Microsoft Active Directory Domain Logon uses Kerberos. Kerberos is an SSO solution; an application may make use of a user's Kerberos credentials without requiring that the user enter their password a second time. The credentials obtained by the application may only be valid for as long as the user's Kerberos ticket - probably at most a week.

If you have a web application, it too may take part in the warm goodness via SPNEGO. You may have seen this in the form of Sharepoint sites that don't require a login if you are on the company domain.

If you have used standard AD-based Windows authentication they shouldn't have your password but they could certainly perform actions using your user context.

If you provide a username/password to login using standard Windows authentication then there is no way for you to be sure they haven't saved that.

If Windows auth issued login tokens that expired this might be a different story, but I do not believe that is how it works and certainly would still be useless with the second case.