I have an OpenLDAP 2.4.23 server up and running in a Linux box L against which I can carry out password authentication on behalf of users logging into an embedded system E. To accomplish this, in L I have an LDIF file with entries along the following lines:<br /><br />dn: uid=xxx,ou=yyy,dc=zzz,dc=com<br />uid: xxx<br />cn: xxx<br />objectClass: account<br />objectClass: posixAccount<br />objectClass: top<br />objectClass: shadowAccount<br />userPassword: ThisIsthePassword<br />shadowLastChange: 14014<br />shadowMax: 99999<br />shadowWarning: 7<br />loginShell: /bin/bash<br />uidNumber: 1003<br />gidNumber: 1003<br />homeDirectory: /home/xxx<br />gecos: ,,,<br /><br />I would like to change this so that, when sending password information from my LDAP client in E to the LDAP server in L, the password itself is never sent in the clear. So I thought to change the value of the userPassword attribute to read<br /><br />{SHA}3DRF4FXpG8r+Ki8i8azuZh7KwO8=<br /><br />instead, where the string above was obtained by means of<br /><br />slappasswd -v -s ThisIsthePassword -h &quot;{SHA}&quot;<br /><br />in L.<br /><br />After restarting the LDAP server in L, when user xxx logs into E with password &quot;ThisIsthePassword&quot; I can verify in the traces of the LDAP server (I am running it as slapd -d 255) that the client in E is sending the &quot;3DRF4FXpG8r+Ki8i8azuZh7KwO8=&quot; string, exactly as specified in the value of the userPassword attribute. However, the authentication is failing.<br /><br />What is it exactly that the LDAP client in L is supposed to be sending to the LDAP server in this case? I noticed that if the client sends the actual &quot;ThisIsthePassword&quot; string instead the authentication also fails. I am obviously missing something here but, what is it?