>> <yokoyamy(a)jacic.or.jp&gt; schrieb am 20.09.2018 um 01:43 in Nachricht

Hi. I have user information in RDB which include user‑id and password set. I’ve been trying to use this RDB as backend database for openldap server. Now,I can find user information in RDB through openldap. However, I recognized I can’t use this user information for ldap login certification process. LDAP’s userPassowrd stored in the RDB has been already DES hashed by original app. On the other hand, input password from ldapseach command line

is CREARTEXT. Now I’d like my openldap to change CREATEXT input password into DES hassed text so that they'll match for certification. I've asked this topic on stackoverflow web site how to do that by server settings.But I couldn’t find proper directives to set. How to make ldap evaluate clear text password vs DES stored password Since then,I’ve been searching LDAP source files which is matching input password from ldapsearch command line against userPassword stored in backend

RDB for slapd. I’d like to change certification process of LDAP source file to make input password into DES hashed by using 2 characters of userPassword as its SALT. I've already known that 2 characters at the beginning of userPasswordwas used as its SALT when it was hashed. So the fact is ,my slapd can read userPassword from the RDB. I think I'll be

able to find out what will be SALT to make input password into DES hashed text. If I can make opeldap to act this way,I can use user's infomation in the RDB

to ldap login inforomation wiht seamless.

LDAP’s userPassowrd stored in the RDB has been already DES hashed by original app. On the other hand, input password from ldapseach command line is CREARTEXT.

I’d like to change certification process of LDAP source file to make input password into DES hashed by using 2 characters of userPassword as its SALT.

I've already known that 2 characters at the beginning of userPasswordwas used as its SALT when it was hashed.

So the fact is ,my slapd can read userPassword from the RDB. I think I'll be able to find out what will be SALT to make input password into DES hashed text.

in message "Re: How to make ldap evaluate clear text password vs DES stored password", Dan White <dwhite(a)cafedemocracy.org&gt; wrote: > On 09/20/18?08:43?+0900, yokoyamy(a)jacic.or.jp wrote: > >LDAP’s userPassowrd stored in the RDB has been already DES hashed by > >original app. On the other hand, input password from ldapseach command > >line is CREARTEXT. > > If the hashed/encrypted password is supported by your local crypt(3) > library, you can prepend the userPassword value with {CRYPT} as specified > in slapd-config(5) and section 14.4.2 of the Admin Guide. > > Else, if you have a pam module which supports authentication of your hash, > take a look at Pass-Through authentication (section 14.5).

My CentOS can make cleartext into DES . hete is a part of my previous slapd.conf olcPasswordHash: {CRYPT} olcSizeLimit: 5000 olcPasswordCryptSaltFormat: "_%s" unfortunately,it didn't work for my issue. i think my slapd uses DES when i try to store new userPasword.

i think unless i fetch userPasdword from RDB through slapd, i will not be able to find SALT in userPassword.

Hi, >LDAP’s userPassowrd stored in the RDB has been already DES hashed by >original app. On the other hand, input password from ldapseach command >line is CREARTEXT. > >I’d like to change certification process of LDAP source file to make input >password into DES hashed by using 2 characters of userPassword as its >SALT. That is how LDAP works if it knows that your passwrd is DES. But the encoding for DES by LDAP may be slightly different from the encoding for DES by your original app. For a DES encrypted password, LDAP expects to see: userpassword: {CRYPT}6FgwLHWxQzlgA where 6F is the salt (LDAP knows that the 6F is the salt) So if your RDB only contains 6FgwLHWxQzlgA, you may have to modify that. Or I did not understood your question. Best regards, Olivier

yokoyamy(a)jacic.or.jp writes: > Hi.thanks for your advice. > > My cas is a bit complicated. > > DES hashed text stored in my RDB is actually cleartext for the RDB itself. > > slapd/ldapsearch show it as cleare text with base64 . If your RDB is storing a DES password compatible for LDAP, it must store a character sting of the form "{CRYPT}F6ojc88jnbdc". The {CRYPT} part is telling LDAP that the string is a DES password. If there is no {CRYPT} part, LDAP assumes that the string is a cleartext password (this is confirmed by what you say below, you can connect if you type the base64/DES text). So you should: - take whatever password text that is currently stored in RDB - remove base64 - append {CRYPT} at the begining - store that back in RDB The RDB will now be storing a DES password that LDAP can use. I suggest that you test with one account before changing all accounts. Does any system use the password in RDB or only LDAP? If only LDAP, you can modify all passwords. If other system use the password, you must have one password in LDAP format ({CRYPT} no base64) and one password for the other applications (no {CRYPT} and base64). Or you must find a way for the RDB to present a different password to LDAP and to the other application (for example, depending on the IP address of the client asking for the password). Best regards, Olivier > > When i give original password,certification process returns invalid credential, > but when i give DES hashed text which is same value of the RRD,certification succeed as you wrote. > > > However,I'd like slapd/ldasearch to change input password to same value in the RDB instead of typing by myslf because,I can read the RDB directory but others can't. > > > > I've confirmed my crypt can hash the text into same value of text in theRDB. > > Any idea? > > in message "Re: How to make ldap evaluate clear text password vs DES stored password", > Olivier <Olivier.Nicole(a)cs.ait.ac.th&gt; wrote: >> Hi, >> >> >LDAP’s userPassowrd stored in the RDB has been already DES hashed by >> >original app. On the other hand, input password from ldapseach command >> >line is CREARTEXT. >> > >> >I’d like to change certification process of LDAP source file to make input >> >password into DES hashed by using 2 characters of userPassword as its >> >SALT. >> >> That is how LDAP works if it knows that your passwrd is DES. >> >> But the encoding for DES by LDAP may be slightly different from the >> encoding for DES by your original app. >> >> For a DES encrypted password, LDAP expects to see: >> userpassword: {CRYPT}6FgwLHWxQzlgA >> where 6F is the salt (LDAP knows that the 6F is the salt) >> >> So if your RDB only contains 6FgwLHWxQzlgA, you may have to modify that. >> >> Or I did not understood your question. >> >> Best regards, >> >> Olivier > > > --

On 09/20/18?08:43?+0900, yokoyamy(a)jacic.or.jp wrote: >LDAP’s userPassowrd stored in the RDB has been already DES hashed by >original app. On the other hand, input password from ldapseach command >line is CREARTEXT. >I’d like to change certification process of LDAP source file to make input >password into DES hashed by using 2 characters of userPassword as its >SALT. >I've already known that 2 characters at the beginning of userPasswordwas >used as its SALT when it was hashed. >So the fact is ,my slapd can read userPassword from the RDB. I think I'll >be able to find out what will be SALT to make input password into DES >hashed text. If the hashed/encrypted password is supported by your local crypt(3) library, you can prepend the userPassword value with {CRYPT} as specified in slapd-config(5) and section 14.4.2 of the Admin Guide. Else, if you have a pam module which supports authentication of your hash, take a look at Pass-Through authentication (section 14.5).

On 09/21/18?12:04?+0900, yokoyamy(a)jacic.or.jp wrote: > >I can't find 'Pass-Through authentication (section 14.5)' >in slapd-config(5) man page. > >Could you send me its URL? http://www.openldap.org/doc/admin24/