On 9/22/2010 10:32 AM, Gerrard Geldenhuis wrote:
>
> Hi
>
> Problem Statement:
>
> If I have the following ldif executed by Directory Manager:
>
> dn: uid=jsmith,ou=People,dc=mycompany
>
> changetype: modify
>
> replace: userPassword
>
> userPassword: 5A80f5A80FFE3A51BA71A0014F88F0204995334D9849DC02E1A7E06dd171
>
> This will get transmitted in clear text (via ssl, if enabled) to the
> server if done remotely and will be subject to any password policy set.
>
> If however the ldif looks like:
>
> dn: uid=smith,ou=People,dc=mycompany
>
> changetype: modify
>
> replace: userPassword
>
> userPassword: {SSHA}Jvze3knNF165Msadf1vfLJTuhKm9wHoRt
>
> It is not subject to the password policy and stil gets changed.
>
> [snip]
Questions:
>
> Is the difference in behaviour when using a clear text password as
> opposed to a {SSHA} password intentional? Granted that it gets
> executed as Directory Manager.
>
I would think that the difference is not only intentional, but
absolutely necessary. SSHA is a *hash*; it is not the password.
There's no way to convert that hash back to a password to determine if
the original data complied with security policies.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.fedoraproject.org/pipermail/389-users/attachments/20100922/4d36eba1/attachment.html
