How to store security credentials in a database
===

I'm working on a CMDB like application, where I have to store our security credentials (servers usernames & passwords, ...).

I'm looking for the best way to store them securely with those constraints :

 - Most users will NOT have access to all credentials (depending on user role)
 - We don't want all passwords being encrypted with the same key (already tried : when a user leave the company, it's a pain to change the key...)
 - Indeed, we don't want any private key to be hard written in app source, or even stored anywhere (in our previous version, private key was stored between our ears...)
 - We need to realize passwords strength audits (ie. parse decrypted passwords from a script)
 - There must not be any case where we can not access our credentials anymore (lost key, ...) => we don't want unauthorized persons to look at them but we don't want to loose them either => solution for this constraint could be regular export into a physical locker...

I'm not asking about application (https, ...) or database (no public access, ...) security concerns themselves but only about the storage side (could even NOT be in a database...? encrypted files or something...) : Is it possible to prevent someone, even having access to app code or database content (worst case scenario), to be able to read decrypted credentials ?

I'm aware that I'm asking for some magic solution, but I want to know it if it exists ;o)