Re: [ldapext] DBIS - new IETF drafts

[Andrew Findlay <[e-mail]>]

On Sat, Jan 11, 2014 at 01:15:03AM +1100, Luke Howard wrote:

> > Ok, so I posed this question just now, but can all LDAP servers you can think of authentication bind operations using CRYPT-style passwords?  If it can be done server-side there'll be no problem here and we need never expose the hashes to clients.
> 
> Active Directory cannot.

True, but there are many things that Active Directory cannot do.
It is not a general-purpose LDAP server: it is a proprietary
database that happens to support an LDAP access method.

As for CRYPT (at least the traditional 13-character DES version) in
other servers:

	OpenLDAP				yes
	IBM Tivoli Directory Server		yes
	389					yes
	OpenDJ					yes
	Sun/Oracle DSEE				yes
	Oracle OID				yes
	Isode M-Vault				yes
	ApacheDS				yes
	Lotus Domino				very unlikely

The only server that I have not been able to find a clear
statement of CRYPT support for is Lotus Domino - and like AD, that
is really not intended as a general-purpose LDAP server.

Of course these days we are not just talking about 13-character
CRYPT in migration jobs. Any decent Unix-like system released in the
past decade or two is likely to use a stronger hash algorithm in
/etc/shadow. Support for those is much more restricted, and normally
depends on the underlying OS to supply the hashing code. Some of the
enterprise distros have only gained support for my preferred hash
algorithms in the past couple of years, so running LDAP servers on
older enterprise OSs can be rather limiting.

Andrew
-- 
-----------------------------------------------------------------------
|                 From Andrew Findlay, Skills 1st Ltd                 |
| Consultant in large-scale systems, networks, and directory services |
|     http://www.skills-1st.co.uk/                [phone]     |
-----------------------------------------------------------------------