Password field in cleartext inside VPN Apple Mobile profiles
Apparently, from the mobile configuration file, it is enough to go the user definition:

&lt;key&gt;XAuthName&lt;/key&gt;
&lt;string&gt;&lt;&lt;LOGIN&gt;&gt;&lt;/string&gt;
&lt;key&gt;XAuthPassword&lt;/key&gt;
&lt;string&gt;&lt;&lt;PASSWORD&gt;&gt;&lt;/string&gt;


And from there, delete the XAuthPassword key and string/attribute. 

As XAuthName is there during the deployment, the password will be asked, as thus wont be in cleartext format inside the provisioning file.