When is PrivateKey password used?

[Brent Putman]

On 6/11/13 1:37 PM, Zmuda, Matthew R wrote:
>
> Looking at the IdPCredentials docs -
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCredentials
>
>  
>
> PrivateKey - The private key file for the credential; only one
> PrivateKey element is allowed. The PrivateKey element may include a
> password attribute with the decryption password for the key.
>
>  
>

I was actually just reviewing the XML schema for the config above. Turns
out the docs above are not consistent with the schema.  I don't know
why, but in July 2008 (shib-common r766)  the support for the password
attribute was removed in the schema.  What is now documented would
actually be schema-invalid.

Given that this was done (I believe) after v2 was released and that it
is a breaking change, I think this was a mistake.  Although since it's
gone nearly 5 years without anyone hitting it, I assume nobody actually
tries to use the password attribute on a PrivateKey.   :-)  

I guess we'll discuss whether to put the support back in the schema, or
just leave it and fix the docs.  The config parsing code seems to still
have the password support, so at first glance it just appears to be the
schema that was messed up.

--Brent