As you imply, probably your best bet is to introduce some form of caching of the POP password that you get back from the LDAP server. The manner in which you do this is the question.

Like you, I would shy away from putting the password into the environment :), but I think you've got the right idea: you want to cache the password on the web machine so that you don't have to keep asking for it from the LDAP machine.

For security reasons, you should definitely encrypt the passwords that you cache; probably your best bet is to just encrypt them using a symmetric cipher, like Crypt::Blowfish, used in CBC mode (Crypt::CBC). You have to be careful with the key you use as the encryption/decryption passphrase; if you store this key in a file anywhere, you're basically negating the benefits of encrypting in the first place. So you need to find a way to store the passphrase w/o storing it in plain text on disk; one way to do this might be to store it in shared memory or something like that.

The question then becomes: how do you cache the passwords?

Several options that I can think of:

• Use something like Cache::Cache to cache the encrypted passwords on disk, in memory, etc. You can set the cached passwords to expire after some amount of time.
• Use something like Apache::Session for the caching; treat the transaction w/ the user as a session, which means that when the user enters, he/she gets a unique session ID. The encrypted mail password then is stored as part of the session data, and you can store that session data in any place that Apache::Session supports: database, filesystem, etc. This scenario works well if you already have the concept of a "session" while the user is actively in the system; the session expires when the user logs out, for example, and then you can get rid of the session file/record/etc.

Either of these options will help you in terms of efficiency, because you're effectively cutting out one of the steps from each request (ie. getting the password).