We have the ability to encrypt passwords in datasource/login-confg.xml files, but the tomcat server.xml parsing does not currently support this. This is something we need to add.