Encrypting OIDC secrets in static metadata

[Simon Lundström]

On Tue, 2024-10-01 at 14:16:21 +0200, Cantor, Scott via users wrote:
> > Java property file/s for the (hashed) secrets sounded
> > sufficient initially, until I remembered that you can't reload
> > those (reliably) in the running IDP.
> 
> You could use the htpasswd file support in the IdP since the client authentication feature supports all the password validators. That is reloadable, though not well tested.

Ooooh, even Kerberos and LDAP[1] is supported! And you can use a
matchExpression="^oidc-.*" to only support certain accounts like
"oidc-my-service-user".

A StaticDataConnector via Attribute Resolver Resolution should also be
reloadable, right? And a ScriptedDataConnector with ScriptFile (easier
to generate a stand alone file) too?

What else is reloadable and easily generated outside of the IDP?

BR,
- Simon

1,
<https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2929033287/OAuth2ClientAuthnConfiguration>