Am 12.03.2010 17:28, schrieb Steve Cross:
Hello all,
Here is the issue that I am having. I have recently setup an OpenLDAP
database for my local network. My goal is to use this for authentication
for all clients on my network. I have been able to configure slapd.conf
and the server will start up and run just fine. I have been using the
migration tools to convert from the Linux style passwd file to .ldif
files to import into my shiny new LDAP database. Everything goes
smoothly, including the ldapadd command to import the ldif files. I am
importing my users and my groups, as well as the base information for my
site. Everything imports in, and i can find every user's DN using
ldapsearch, but whenever I try to authenticate with any user imported
from the passwd file, it fails authentication. However, if i go and
change the user's password with ldappasswd then it will let me
authenticate just fine for that user. I think this issue has to do with
the fact that ldapadd automatically hashes the value stored in
userPassword, but this seems to be causing issues with the SMD5
passwords that are stored in my shadow file. I've tried using
{CLEARTEXT}, {CRYPT}, {MD5}, and {SMD5} before the value in the
userPassword field, but no matter what i cannot login with the user's
actual password. Is there any way to prevent ldapadd from hashing the
userPassword value, since it already is encrypted? If not, what is the
correct method for importing from passwd file that will not require me
to change every user's password manually once imported into the LDAP
directory. Below is my system setup.
Slackware Linux 12.2
OpenLDAP 2.4.21 compiled from source
passwd file encryption type: Salted MD5
If you need any more information please don't hesitate to ask. I am
willing to provide any information necessary to get this going. Any help
or pointers that I can get on this situation would be GREATLY appreciated.
Thanks,
Steve
Hi Steve,
OpenLDAP doesn't hash the passwort on adding it. What ldapsearch shows
you is the base64 encoded value of userPassword which will decode to the
text from the ldif file you added.
You say that you compiled OpenLDAP from source. Did you set the
'--enable-crypt' option for configure? The {CRYPT} password scheme is
disabled by default.
Regards,
Christian Manal