Encrypting OIDC secrets in static metadata

[Henri Mikkonen]

Hi Keith,

On 1.10.2024 1.04, Wessel, Keith via users wrote:
> Is it possible, or are there plans to make it possible, to encrypt those 
> stored secrets with some key known only to the IdP? Seems trivial enough 
> with a two-way encryption algorithm used from my novice perspective.

Check the "client secret resolution by reference" section, especially 
the "attribute resolution resolution":

https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879133/OPMetadataClientRegistration#Attribute-Resolver-Resolution

In short, this method will provide you means to resolve the plaintext 
client secret value via IdP's attribute resolver engine. The reference 
key is set via ClientSecretKeyReference SAML metadata element. As all 
the features of IdP's attribute resolver are available, you should find 
good building blocks for various use cases: including local encryption 
of the values or for instance fetching the values via API from a remote 
server.

BR,
Henri.