On Wed, 2017-04-19 at 13:57 -0400, Mark Reynolds wrote:
On 04/19/2017 01:33 PM, James Chamberlain wrote:
> Hi all,
> Does anyone know, can the CRYPT plugin for 389-ds be passed a
> “crypt-algorithm” parameter? I came across some documentation* from
> the related Oracle Unified Directory / OpenDS which looks like it
> would do exactly what I’m looking for, but I wasn’t sure whether that
> was also true of 389-ds.
We do not offer this functionality for CRYPT at this time, but please
open a ticket so we can look into adding it:
Please provide the links to the Oracle docs, etc.
I had a bit of a read, and I'm not sure about this.
Like, I can see *why* you want to do this, because it makes migration
from these possible.
However, the crypt module is bad, and all those schemes are "weak" for
password storage now.
So, lets say there is a compromise here on this feature.
What if we made it so DS could *bind* a user with the hash set to this
scheme, but you could never make a new password with this scheme. IE you
But your user has:
So you could bind to this account, but then on next password change the
userPassword would become:
What do you think of this solution?
Red Hat, Australia/Brisbane