[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: userPassword question

Chris Newman wrote:
> 
> On Fri, 24 Jul 1998, Bob Bick wrote:
> > <HTML>
> > From a newbie...
> >
> > <P>When I retrieve an LDAP attribute value for the "userPassword" attribute,
> > the attribute value appears to be encrypted (probably a good thing). However,
> > I would like to compare the userPassword with the actual password.
> 
> Isn't it a violation of RFC 2256 to have the value of the userPassword
> attribute encrypted in a way that is visible to the protocol?  Or is my
> inexperience with LDAP showing?
> 
>                 - Chris
It may be a violation to store the password encrypted, but I think the
problem lies deeper. First of all, a password stored in the UNIX "crypt"
style cannot be "decrypted" (unless you mount an exhaustive search or a
dictionary attack). This aside, I think it is usually not needed for
applications to read and compare the userPassword entry. Any application
that wants to do an authentication should do a "bind" operation on the
LDAP server. This makes the application independent of the actual
authentication used by the server (I modified umich ldap to use the
regular UNIX user database for authentication, the LDAP server did not
even have an userPassword attribute)

Andreas
-- 
Microsoft -- definitly needs Viagra