Password field in cleartext inside VPN Apple Mobile profiles I have here created a web site to deliver mobile profiles to BYOD Apple devices to configure our corporate VPNs.

The user as to authenticate in that site, his password is checked against our AD, and a signed mobile profile is then delivered.

In iPhones/iPads, the file is just used on the fly, and not saved. As for Mac notebooks, the file is used, but remains in the file system. 

The security problem there is that password is in the cleartext for anyone that bothers to open the file.

The alternative to keep the web site, may well be not delivering the password in the profile. 

Does mobile profile functionally support obfuscating the user password field in some way?

P.S. I am aware other alternative is to setup an alternative authentication scheme to users with non-critical passwords. It is not the answer that I am after on this context of Apple devices.
Apparently, from the mobile configuration file, it is enough to go the user definition:

&lt;key&gt;XAuthName&lt;/key&gt;
&lt;string&gt;&lt;&lt;LOGIN&gt;&gt;&lt;/string&gt;
&lt;key&gt;XAuthPassword&lt;/key&gt;
&lt;string&gt;&lt;&lt;PASSWORD&gt;&gt;&lt;/string&gt;


And from there, delete the XAuthPassword key and string/attribute. 

As XAuthName is there during the deployment, the password will be asked, as thus wont be in cleartext format inside the provisioning file.