Filesystem rights with ODBC

[Kristof Bajnok]

Hi,

I'm trying to get ODBC StorageService working, however, it seems that it
requires the connection secrets to be present in shibboleth2.xml. I've
tried to limit read rights to shibd group only, but it turned out that
this file must be read by the unprivileged webserver user as well.

Does mod_shib really need to access StorageService configuration? If
not, is there by any chance any way to hide the database secrets from
the webserver?

I'm not too optimistic about the answer but thank you in advance anyway.

Kristof