Hello,
I want to convert my client (ADSI and C++) for use OpenLDAP. I know I must encode the unicodePwd. With ADSI, Miscrosoft give me some functions to do that. How can I do same things from OpenLDAP ?
Thanks,
Jean-Michel
Jean-Marc Choulet wrote:
I want to convert my client (ADSI and C++) for use OpenLDAP. I know I must encode the unicodePwd. With ADSI, Miscrosoft give me some functions to do that. How can I do same things from OpenLDAP ?
The best way of setting a password is to use the LDAP Password Modify Extended Operation as described in RFC 3062 and let the server generate the password hash:
http://tools.ietf.org/html/rfc3062
The second way is to send a modify request for replacing password with a client-side hashed userPassword value.
An (incomplete) attempt to describe the variants was made here: http://tools.ietf.org/html/draft-stroeder-hashed-userpassword-values
Some more information here: http://www.openldap.org/faq/data/cache/419.html
Some server implementations are capable of auto-hashing clear-text userPassword values at the server-side, e.g. OpenLDAP with slapo-ppolicy and config directive ppolicy_hash_cleartext. But that depends on server configuration.
Ciao, Michael.
Hello Michael,
And, if I want to use openldap API to change AD user password in C/C++. I can do that with Perl without problem but not with openldap library and C/C++. Do you have a example (or some documentation) for me ?
Thanks,
Jean-Marc
Le 02/04/2014 20:55, Michael Ströder a écrit :
Jean-Marc Choulet wrote:
I want to convert my client (ADSI and C++) for use OpenLDAP. I know I must encode the unicodePwd. With ADSI, Miscrosoft give me some functions to do that. How can I do same things from OpenLDAP ?
The best way of setting a password is to use the LDAP Password Modify Extended Operation as described in RFC 3062 and let the server generate the password hash:
http://tools.ietf.org/html/rfc3062
The second way is to send a modify request for replacing password with a client-side hashed userPassword value.
An (incomplete) attempt to describe the variants was made here: http://tools.ietf.org/html/draft-stroeder-hashed-userpassword-values
Some more information here: http://www.openldap.org/faq/data/cache/419.html
Some server implementations are capable of auto-hashing clear-text userPassword values at the server-side, e.g. OpenLDAP with slapo-ppolicy and config directive ppolicy_hash_cleartext. But that depends on server configuration.
Ciao, Michael.
Hi,
On Thu, 3 Apr 2014, Jean-Marc Choulet wrote:
Hello Michael,
And, if I want to use openldap API to change AD user password in C/C++. I can do that with Perl without problem but not with openldap library and C/C++. Do you have a example (or some documentation) for me ?
see the ldpapasswd cli tool in the openldap source code.
Greetings Christian
Thanks,
Jean-Marc
Le 02/04/2014 20:55, Michael Ströder a écrit :
Jean-Marc Choulet wrote:
I want to convert my client (ADSI and C++) for use OpenLDAP. I know I must encode the unicodePwd. With ADSI, Miscrosoft give me some functions to do that. How can I do same things from OpenLDAP ?
The best way of setting a password is to use the LDAP Password Modify Extended Operation as described in RFC 3062 and let the server generate the password hash:
http://tools.ietf.org/html/rfc3062
The second way is to send a modify request for replacing password with a client-side hashed userPassword value.
An (incomplete) attempt to describe the variants was made here: http://tools.ietf.org/html/draft-stroeder-hashed-userpassword-values
Some more information here: http://www.openldap.org/faq/data/cache/419.html
Some server implementations are capable of auto-hashing clear-text userPassword values at the server-side, e.g. OpenLDAP with slapo-ppolicy and config directive ppolicy_hash_cleartext. But that depends on server configuration.
Ciao, Michael.
openldap-technical@openldap.org
-
Christian Kratzer -
Jean-Marc Choulet -
Michael Ströder