Encrypting OIDC secrets in static metadata

[Peter Schober]

Wessel, Keith via users <users at shibboleth.net> [2024-10-01 00:04 CEST]:
> I see that OIDC client secrets in the IdP can now be SHA hashed
> which, as the documentation says, doesn't encrypt them but at least
> slightly obfuscates them.
> 
> Is it possible, or are there plans to make it possible, to encrypt
> those stored secrets with some key known only to the IdP? Seems
> trivial enough with a two-way encryption algorithm used from my
> novice perspective.

FWIW, I'm generating my OIDC client info from Ansible, getting the
secrets from an encrypted Ansible Vault. The source data (including
encrypted client secrets) is stored in a (private) git repo.
I'm currently populating these secrets into the resulting file/s on
the IDP in cleartext but will be changing that to be hashed next.

I haven't yet thought about how to handle these things once a part of
that client info might be removed, to be replaced with unregistered
clients via policy.
Java property file/s for the (hashed) secrets sounded sufficient
initially, until I remembered that you can't reload those (reliably)
in the running IDP.

-peter