Hi Ann,

Typically these days, we advise customers to single-source their authentication in their primary authentication systems. So combinations like Active Directory as IdP and Active Directory Federated Services (ADFS) as STS or LDAP and PingFederate, etc). We will come back to Federating Security in some months in a webinar...

In your request you are using the CMS as Identity Provider (IdP) and ISHSTS as Secure Token Service (STS). So in this scenario the CMS owns the password and there are some password rules, see https://docs.rws.com/992513/72001/tridion-docs-14-sp4/login-settings 

The short answer to your question is that the password is plain text as in your example. Do note that all systems run HTTPS - so encryption in flight.

Longer answer, some inspiration can be found on below links. One is old example code to synchronize user profiles from Active Directory into the CMS. The other are the tests of the Add-IshUser cmdlet that could inspire you on options.

• Synchronize - so add/disable/delete/alter-rights - on InfoShare user profiles with a group of Active Directory users. This maintains the necessary Knowledge Center Content Manager (= LiveContent Architect = Trisoft InfoShare) user profiles for usage with (indirect) Windows Authentication. https://gist.github.com/ddemeyer/c80ef8a5a6025eb2267a9c1a91c3a9c4 
• ISHRemote/AddIshUser.Tests.ps1 at master · RWS/ISHRemote https://github.com/RWS/ISHRemote/blob/master/Source/ISHRemote/Trisoft.ISHRemote/Cmdlets/User/AddIshUser.Tests.ps1

Best wishes,
Dave