Native SP: Externalize credential resolver passwords

[Ove Gram Nipen]

Hi, 

I am using Shibboleth 2 Native SP together with Apache 2 to protect my web application. In my shibboleth2.xml I have a CredentialResolver block that looks something like this: 


    shibboleth2.xml
    ---------------
    ...
    <CredentialResolver type="File">
        <Key password="secret" format="PKCS12">
            <Path>sp-cert.p12</Path>
        </Key>
        <Certificate password="secret" format="PKCS12">
            <Path>sp-cert.p12</Path>
        </Certificate>
    </CredentialResolver>
    ...


I'd like to keep my configuration under source control, but I'd rather not commit my key passwords. Is it possible to put the password somewhere else - not in shibboleth2.xml? Can I for instance use an external property file, an environment variable, a startup parameter to shibd or something like that?

-- 
Best regards, 
Ove Gram Nipen