Windows Sync (via changelog) only works with front-ends sending uncenctyped passwords

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello everybody and a BIG thanks to Rich, and the rest of you, for your kind aid. Can you please help with something else ?
 
HISTORY-------
 
We're currently investigating using Windows SYNC but only the password part of the SYNC functionality - no accounts.
 
My prototype works fine - if I change a password with Windows Cntl+Alt+Del itis propogated to Redhat Directory Server (RHDS). If I change the RHDS password with a simple front end itis propogated to Windows Active-Directory (Netscape console, for example, or a script with userpassword: secret-password ).
 
I read the following:
Directory Server passwords are synchronized along with other entry attributes because plain-text passwords are retained in the Directory Server changelog.
Source: http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Windows_Sync.html#Windows_Sync-About_Windows_Sync
 
PROBLEM ?---------
 
I think this only works with RHDS and password changing front-ends that send the password unencrypted.
 
For example, if I do something like the following with RHDS:
 
./ldapmodify -P "/root/.mozilla/firefox/acu5w0yl.default/cert8.db" -c -h ${DEST_HOST} -p ${DEST_PORT} -D "${DEST_BIND}" -w $DESTDN_PASSWORD <<EOFdn: uid=${TGI},ou=People,${DEST_SUFFIX}changetype: modifyreplace: userpassworduserpassword: {SHA}v9KDMpMQgX13LuXtmWzmSaIcNGM=EOF
 
Note: Please note the {SHA} stuff in 'userpassword'.
 
I cannot see how, using the changelog, RHDS can unencrypt the password from {SHA} so as to re-encode it in unicodePwd for sending to Active-Directory.
unicodePwd: good link http://www.eyrie.org/~eagle/journal/2007-07/010.html
 
My tests show that it doesn't work: After running the script I cannot login to Windowsusing my account/secret-password.
 
If however, I change my script to use the password unencrypted (userpassword: secret-password) the propogation works again and I can log into my Windows client.
 
Q1. Am I correct that it only works with RHDS front-ends that send the password unencrypted ?
Thanks, 
_________________________________________________________________
Show them the way! Add maps and directions to your party invites.
http://www.microsoft.com/windows/windowslive/events.aspx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.fedoraproject.org/pipermail/389-users/attachments/20090116/c161d56b/attachment.html 


[Index of Archives]     [Fedora User Discussion]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora News]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora QA]     [Fedora Triage]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Yosemite Photos]     [Linux Apps]     [Maemo Users]     [Gnome Users]     [KDE Users]     [Fedora Tools]     [Fedora Art]     [Fedora Docs]     [Maemo Users]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Fedora ARM]

  Powered by Linux