Hi Gimmy;
The other thing I have in my framework is a Login dialogue that uses the MS-Windows login API to verify the user. My suggestion would be to use this once in your application to capture the real password - then using my framework's encryption, store the encrypted password in an accessible location (ie INI file).
Now that you have a copy of the encrypted PW, just drop that into your SQLCA for the Oracle login's SSO approach.
FWIW: I would call the MS-Login API each time your start your application to get an OK return code with the UID & saved PWD. If the user has changed their MS-Windows login PWD, the RC will show a failure. In that case, open my MS-Windows Login dialogue again to get the user to re-enter the new password and then update the encrypted PW in your INI file. From there, the system should not prompt the user again until they change their PW again.
Food for thought.
HTH
Regards ... Chris