> On 9 Mar 2019, at 01:17, Gordon Messmer <gordon.messmer@xxxxxxxxx> wrote: > > On 3/8/19 4:58 AM, Janet Houser wrote: >> Thanks! >> >> I read that but I can't switch to freeipa since that software doesn support a hash needed with gsync. >> >> hmmmm...... I wonder if I could sync the user/password DB to freeipa and then use that to serve out samba shares..... > > > I don't think FreeIPA generates password hashes outside of the directory. I'd expect it to store whatever hash you configure 389 DS to store, if you change that setting directly in the directory service. FreeIPA has it’s own password module that “intercepts” the DS password change operation, and does extra work. It’s quite complex and hard to get ones head around. So DS still hashes based on configuration (Should be PBKDF2 on 1.4.x, SSHA512 on 1.3.x), but extra hashes + krb are added/changed in the process, including ipaNTHash if the adtrust prep was run. > > On the other hand, I wouldn't recommend syncing password hashes at all. Google Cloud supports third-party SSO using SAML 2.0. You should be able to use GCDS to sync your user accounts, and use SAML for authentication. Yes, this is a better solution than trying to sync hashes. IIRC googles hash format is really weak that they accept for sync, so external portal like this is better. > > _______________________________________________ > 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx > To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx — Sincerely, William Brown Software Engineer, 389 Directory Server SUSE Labs _______________________________________________ 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
