Re: Issues migrating from Linux passwd file to OpenLDAP

[Christian Manal <moenoel@informatik.uni-bremen.de>]

Am 12.03.2010 17:28, schrieb Steve Cross:
> Hello all,
> 
> Here is the issue that I am having. I have recently setup an OpenLDAP
> database for my local network. My goal is to use this for authentication
> for all clients on my network. I have been able to configure slapd.conf
> and the server will start up and run just fine. I have been using the
> migration tools to convert from the Linux style passwd file to .ldif
> files to import into my shiny new LDAP database. Everything goes
> smoothly, including the ldapadd command to import the ldif files. I am
> importing my users and my groups, as well as the base information for my
> site. Everything imports in, and i can find every user's DN using
> ldapsearch, but whenever I try to authenticate with any user imported
> from the passwd file, it fails authentication. However, if i go and
> change the user's password with ldappasswd then it will let me
> authenticate just fine for that user. I think this issue has to do with
> the fact that ldapadd automatically hashes the value stored in
> userPassword, but this seems to be causing issues with the SMD5
> passwords that are stored in my shadow file. I've tried using
> {CLEARTEXT}, {CRYPT}, {MD5}, and {SMD5} before the value in the
> userPassword field, but no matter what i cannot login with the user's
> actual password. Is there any way to prevent ldapadd from hashing the
> userPassword value, since it already is encrypted? If not, what is the
> correct method for importing from passwd file that will not require me
> to change every user's password manually once imported into the LDAP
> directory. Below is my system setup.
> 
> Slackware Linux 12.2
> OpenLDAP 2.4.21 compiled from source
> passwd file encryption type: Salted MD5
> 
> If you need any more information please don't hesitate to ask. I am
> willing to provide any information necessary to get this going. Any help
> or pointers that I can get on this situation would be GREATLY appreciated.
> 
> Thanks,
> 
> Steve


Hi Steve,

OpenLDAP doesn't hash the passwort on adding it. What ldapsearch shows
you is the base64 encoded value of userPassword which will decode to the
text from the ldif file you added.

You say that you compiled OpenLDAP from source. Did you set the
'--enable-crypt' option for configure? The {CRYPT} password scheme is
disabled by default.


Regards,
Christian Manal