Providing a password for an encrypted private key

[kc548]

Hello,

I'm trying to set up SATOSA with a key_file parameter containing an encrypted private key.

However, I get the following error :

[2026-06-01 14:30:27,003] [ERROR] [saml2.sigver.security_context] Cannot import key from /etc/satosa/certs/sp.key: Password was not given but private key is encrypted
Password was not given but private key is encrypted
[2026-06-01 14:30:27,003] [ERROR] [satosa.proxy_server.make_app] Failed to create WSGI app.
Traceback (most recent call last):
  File "/usr/local/lib/python3.13/site-packages/satosa/proxy_server.py", line 197, in make_app
    res1 = WsgiApplication(satosa_config)
  File "/usr/local/lib/python3.13/site-packages/satosa/proxy_server.py", line 119, in __init__
    super().__init__(config)
    ~~~~~~~~~~~~~~~~^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/satosa/base.py", line 56, in __init__
    backends = load_backends(self.config, self._auth_resp_callback_func,
                             self.config["INTERNAL_ATTRIBUTES"])
  File "/usr/local/lib/python3.13/site-packages/satosa/plugin_loader.py", line 44, in load_backends
    backend_modules = _load_plugins(
        config.get("CUSTOM_PLUGIN_MODULE_PATHS"),
        config["BACKEND_MODULES"],
        backend_filter, config["BASE"],
        internal_attributes, callback)
  File "/usr/local/lib/python3.13/site-packages/satosa/plugin_loader.py", line 181, in _load_plugins
    instance = module_class(callback, internal_attributes, module_config, base_url,
                            plugin_config["name"])
  File "/usr/local/lib/python3.13/site-packages/satosa/backends/saml2.py", line 119, in __init__
    sp_config = SPConfig().load(copy.deepcopy(config[SAMLBackend.KEY_SP_CONFIG]))
  File "/usr/local/lib/python3.13/site-packages/saml2/config.py", line 338, in load
    self.load_complex(cnf)
    ~~~~~~~~~~~~~~~~~^^^^^
  File "/usr/local/lib/python3.13/site-packages/saml2/config.py", line 272, in load_complex
    self.setattr("", "metadata", self.load_metadata(cnf["metadata"]))
                                 ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/saml2/config.py", line 385, in load_metadata
    mds = MetadataStore(
        acs,
    ...<3 lines>...
        http_client_timeout=self.http_client_timeout,
    )
  File "/usr/local/lib/python3.13/site-packages/saml2/mdstore.py", line 1024, in __init__
    self.security = security_context(config)
                    ~~~~~~~~~~~~~~~~^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/saml2/sigver.py", line 977, in security_context
    rsa_key = import_rsa_key_from_file(_file_name)
  File "/usr/local/lib/python3.13/site-packages/saml2/sigver.py", line 460, in import_rsa_key_from_file
    key = saml2.cryptography.asymmetric.load_pem_private_key(data)
  File "/usr/local/lib/python3.13/site-packages/saml2/cryptography/asymmetric.py", line 10, in load_pem_private_key
    key = _serialization.load_pem_private_key(data, password)

How can I provide the password for my private key ? I checked the SATOSA and pysaml2 documentation but I did not find any relevant parameter to achieve this.

Thanks.

[vladimir-mencl-eresearch]

Sorry, I believe that's not supported. Looking through https://github.com/IdentityPython/pysaml2/blob/master/src/saml2/config.py, there is no way to specify the private key passphrase in pysaml2 config. And looking into pysaml2 src/saml2/sigver.py, CryptoBackendXmlSec1 pass key_file to xmlsec1 without a way to specify the key passphrase.