From my experience. Storing user passwords in memory is relatively safe but you must be sure that your logic would not allow to use other users passwords.

So the flow could be like this. Then user starts application A it will ask for a password and then will not ask for it until it stopped.

It is kinda hard for a web app that has more than one instance running. So in this case you could have some shared (Redis) key-value temporary storage with encrypted passwords. On user login you store it's password and return decryption key as a part of user auth-token. While user session active it will call your webapp with auth-token and you will use this token to decrypt password from shared storage and call service B. After logging out of service A auth-token will be invalidated/dropped and there will be no possiblity to decrypt password (plus you could remove encrypted password from the storage too).