Re: How to make ldap evaluate clear text password vs DES stored password

[Olivier <Olivier.Nicole@cs.ait.ac.th>]

yokoyamy@jacic.or.jp writes:

> Hi.thanks for your advice.
>
> My cas is a bit complicated.
>
> DES hashed text stored in my RDB is actually cleartext for the RDB itself.
>
> slapd/ldapsearch show it as cleare text with base64 .

If your RDB is storing a DES password compatible for LDAP, it must store
a character sting of the form "{CRYPT}F6ojc88jnbdc".

The {CRYPT} part is telling LDAP that the string is a DES password. If
there is no {CRYPT} part, LDAP assumes that the string is a cleartext
password (this is confirmed by what you say below, you can connect if
you type the base64/DES text).

So you should:

- take whatever password text that is currently stored in RDB
- remove base64
- append {CRYPT} at the begining
- store that back in RDB

The RDB will now be storing a DES password that LDAP can use.

I suggest that you test with one account before changing all accounts.

Does any system use the password in RDB or only LDAP? If only LDAP, you
can modify all passwords. If other system use the password, you must
have one password in LDAP format ({CRYPT} no base64) and one password
for the other applications (no {CRYPT} and base64). Or you must find a
way for the RDB to present a different password to LDAP and to the other
application (for example, depending on the IP address of the client
asking for the password).

Best regards,

Olivier

>
> When i give original password,certification process returns invalid credential,
> but when i give DES hashed text which is same value of the RRD,certification succeed as you wrote.
>
>
> However,I'd like slapd/ldasearch to change input password to same value in the RDB instead of typing by myslf because,I can read the RDB directory but others can't.
>
>
>
> I've confirmed my crypt can hash the text into same value of text in theRDB.
>
> Any idea?
>
> in message "Re: How to make ldap evaluate clear text password vs DES stored password",
> Olivier <Olivier.Nicole@cs.ait.ac.th> wrote:
>> Hi,
>> 
>> >LDAP’s userPassowrd stored in the RDB has been already DES hashed by
>> >original app. On the other hand, input password from ldapseach command
>> >line is CREARTEXT.
>> >  
>> >I’d like to change certification process of LDAP source file to make input
>> >password into DES hashed by using 2 characters of userPassword as its
>> >SALT.
>> 
>> That is how LDAP works if it knows that your passwrd is DES.
>> 
>> But the encoding for DES by LDAP may be slightly different from the
>> encoding for DES by your original app.
>> 
>> For a DES encrypted password, LDAP expects to see:
>> userpassword: {CRYPT}6FgwLHWxQzlgA
>> where 6F is the salt (LDAP knows that the 6F is the salt)
>> 
>> So if your RDB only contains 6FgwLHWxQzlgA, you may have to modify that.
>> 
>> Or I did not understood your question.
>> 
>> Best regards,
>> 
>> Olivier
>
>
>

--