Salted passwords, further clarification please

["m h" <sesquile@gmail.com>]

Hi all.

I'm trying to write a script to change the rootpw value in slapd.conf.
Before allowing the user to change the password, I'm asking that they
first verify the existing password.

My question has to do with the random salt.  How do I verify the
existing password?  Going through slappasswd doesn't appear to work,
since it uses a random salt each time.  ie:

r52 ~ # slappasswd -s foo
{SSHA}OBe71ShE85Wd8PINTJzunxazszPWpon1
r52 ~ # slappasswd -s foo
{SSHA}OCK0lxJa+pfFqDfE39N3EZ8529IZIMhd

It doesn't appear from the man page for slappasswd that you can
specify the salt.

Furthermore, how does the server know what the salt is?  (I read
through the FAQ on the website and it says the salt is added to the
password before encryption).

A little confused.  Anything enlightening would be wonderful!  Thanks much.

matt