Shibboleth IDP signing and encryption keys protected by a password

[Rod Widdowson]

> Could you give us more light about how could we achieve this?

Assuming a V3 relying party format.

>From a quick squint at the code the following should work:

In credentials.xml where you have this stanza:

    <!-- Your IdP's default signing key, set via property file. -->
    <bean id="shibboleth.DefaultSigningCredential"
        class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
        p:privateKeyResource="%{idp.signing.key}"
        p:certificateResource="%{idp.signing.cert}"
        p:entityId-ref="entityID" />

add a line 
    p:privateKeyPassword="password"

and so on.  The generation of such a key is left as an exercise for the reader.

There are several reasons why this might not work which I'll not burden the list with, but it should be your first attempt.  If this doesn't work let the list know and I'll work out the precise details.

Rod