Since you hadn’t mentioned PBKDF2 or SHA256 (or higher), a usage of salts, nor handling authentication across service boundaries in an enterprise context, this is essentially an advertisement for using a third-party service.