0

I'm trying to add users to an ApacheDS directory (I'm using the .NET DirectoryServices API) and I'm hitting an error when saving the entry to the directory.

As far as I can see, the password is stored as a Salted SHA hash and in order to verify a user-entered password, I will need to know the original hash, right?

Using Apache Directory Studio, I can see the original salt using the "Password Editor", so the salt is obviously stored somewhere, so how do I store the salt in the directory entry so that I can later retrieve it to salt and hash the user input and check against the stored password?

Greg B
  • 14,597
  • 18
  • 87
  • 141
  • 3
    If your objective is to verify the user, then you should perform a bind (provide the users DN and cleartext password) for the user against the LDAP instance. You should never need the hash itself. – jwilleke Jan 31 '15 at 10:29
  • Not necessarily. You can authenticate as an application and check other users passwords. – user2108278 Feb 22 '17 at 13:04

1 Answers1

0

The salt is stored along with the hash, you can strip the hashing mechanism name found in the beginning of the value of 'userPassword'(e.g. {ssha}) and then extract salt and password from the remaining value based on the type of the hashing mechanism.

kayyagari
  • 1,882
  • 13
  • 10