RFC 2307 section 5.3 http://developer.netscape.com/tech/overview/index.html?content=/docs/technote/ldap/pass_sha.html The OpenLDAP server differs somewhat from the Netscape Directory Server. In particular, the OpenLDAP server will not automatically hash a cleartext userPassword (received from an LDAP client). But the client may send it a hashed value.