1

So I'm writing C++ code that wraps OpenLDAP's C code to set up a basic client controller (so I can connect to a server, view users, etc.).

Whenever I add a new user though, the password gets encrypted as {CRYPT} but I need it as {SSHA}. There also doesn't appear to be a way to just input a plain password (as in, encrypt it yourself and then put it in). It always encrypts it into {CRYPT}. I was told that OpenLDAP supports {SSHA}.

I'm using the following code to set the password when adding a new user:

passVals[0] = passwordC;
passVals[1] = NULL;
char passwordT[] = "userPassword";
passMod.mod_op = 0;
passMod.mod_type = passwordT;
passMod.mod_vals.modv_strvals = passVals;

Where passVals is char*, passMod is LDAPMod*, passwordT is the name of the attribute for the password, and passwordC is the user password (in this case just a simple test password called "newPassword").

passMod is then passed into an LDAPMod** that handles all the user attributes, which I then pass into ldap_add_ext_s(...). This works for everything except the user password, which doesn't encrypt right.

Expected output:

{SSHA} <string of characters/numbers here>

Actual output:

{CRYPT}$6$y63RUAlxygdasWNT$jh3.QRVtQT9nCRyjo6cFlGFimHCyUFRwdLk6wqZTCZh1JKWTB35at0M/aghuCul9GaCbzowkm6YfPZkGKhgiW/

I can't find any options or functions to change this. The same issue happens when I update the password of an existing user with ldap_extended_operation(...), even if the original password was {SSHA}.

Any help is appreciated. I'm also okay with a solution that involves just setting the password as plain text (not auto encrypting), as I could encrypt it myself elsewhere. The problem is that it always forces the wrong encryption no matter what.

starball
  • 20,030
  • 7
  • 43
  • 238
Deoxys_0
  • 65
  • 7
  • Why does this have both the [tag:c] and [tag:c++] tags? Your question body says this is c++ code, so I think you should [edit] to remove the [tag:c] tag. – starball Oct 20 '22 at 07:19
  • Because I'm wrapping C code in C++, so it's both and both sets of rules need to be applied, such as how the C side functions cannot take regular strings. – Deoxys_0 Oct 20 '22 at 12:23
  • Oh dear I should have read carefully before commenting! Sorry about that. Thanks for the explanation. I'll be more careful in the future. – starball Oct 20 '22 at 16:58
  • The password encryption scheme must be defined on the server, you can apply it to slapd configuration using `olcPasswordHash` (or `password-hash` in old slapd.conf mode). See this [post](https://serverfault.com/questions/571928/how-do-you-set-password-hash-for-openldap). – EricLavault Oct 22 '22 at 13:27

0 Answers0