[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: pwdHistory, encrypted passwords and selfservice application



Dario Zanzico wrote:
On Thu, Oct 29, 2015, at 11:18 AM, Bogdan Rudas wrote:
Hello all,
I'm working on Self-service application and want to prevent user from
re-using old passwords. What is correct way to chage password takin in
mind
password history?

I guess it is:
1. Bind with special user and check if specified uid exists
2. Bind using user-supplied uid and password
3. Get password policy, history etc. and  validate on selfservice-side
4. Execute LDAP modifyRequest with single item: userPassword and value of
new hashed password.

In my case same password gives same hash. Are there any way to force
encrypted password history validation on server side?

you could leave points 3 and 4 to a ppolicy overlay (server side)
http://www.openldap.org/doc/admin24/overlays.html (12.10)

You should set, in your policy(es), the
olcPPolicyHashCleartext
attribute to true and send the new password as cleartext so the overlay
can test it against your requisites and, if those checks are successful:
- encrypt it
- rotate the pwdHistory attributes (which stores the last $pwdInHistory
password hashes)

take a look at the slapo-ppolicy manpage

ppolicyHashCleartext is a kludge. The correct approach is to use the passwordModify operation.

--
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/