Hi all,<div><br></div><div>Willian, you can do so by changing <span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); "><b style="font-weight: bold; ">password-hash </b></span><span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); ">param from your slapd.conf file. This param takes one or more hashing functions to be used for storing password hashed version.</span></div>
<div><span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); "><br></span></div><div><span class="Apple-style-span" style="background-color: rgb(255, 255, 255); "><font class="Apple-style-span" face="arial, sans-serif">As stated in slapd.conf (5) man page:</font></span></div>
<div><span class="Apple-style-span" style="background-color: rgb(255, 255, 255); "><font class="Apple-style-span" face="arial, sans-serif"><br></font></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;">
<div><span class="Apple-style-span" style="background-color: rgb(255, 255, 255); "><font class="Apple-style-span" face="arial, sans-serif">{SHA} and {SSHA} use the SHA-1 algorithm (FIPS 160-1), the latter with a seed as of </font></span>{MD5} and {SMD5} use the MD5 algorithm (RFC 1321), the latter with a seed.</div>
</blockquote><div><br></div><div>You can add the following to make your setup work</div><div><br></div><div>password-hash {SSHA} {SHA}</div><div><br></div><div>or</div><div><br></div><div>password-hash {SSHA} {MD5}</div>
<div>
<br></div><div>This will add a new userPassword attribute to objects when they call the LDAP Password Modify Extended Operations (RFC 3062).</div><div><br></div><div>As of stated in man page:</div><div><br></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;">
<div><span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); ">Note that this option does not alter the normal user applications handling of userPassword during LDAP Add, Modify, or other LDAP operations.</span> </div>
</blockquote><div><font class="Apple-style-span" face="arial, sans-serif"><br></font></div><div><font class="Apple-style-span" face="arial, sans-serif">After making the change in slapd.conf, you need to restart the deamon and let all users change their passwords (in normal fashion or forced by password expire).</font></div>
<div><font class="Apple-style-span" face="arial, sans-serif"><br></font></div><div><font class="Apple-style-span" face="arial, sans-serif">Best Regards<br clear="all"></font></div><div><br></div><div>Alexandre Alencar<br>
Twitter @alexandreitpro<br><div><a href="http://blog.alexandrealencar.net/" target="_blank">http://blog.alexandrealencar.net/</a><br><a href="http://www.alexandrealencar.net/" target="_blank">http://www.alexandrealencar.net/</a></div>
<div><a href="http://www.alexandrealencar.com" target="_blank">http://www.alexandrealencar.com</a></div><div><a href="http://www.servicosdeti.com.br/" target="_blank">http://www.servicosdeti.com.br/</a></div><div>COBIT, ITIL, CSM, LPI, MCP-I<br>
<div><br></div></div><br>
<br><br><div class="gmail_quote">On Fri, Aug 19, 2011 at 2:50 PM, William Muriithi <span dir="ltr"><<a href="mailto:william.muriithi-Re5JQEeQqe8@public.gmane.orgm">william.muriithi-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Afternoon,<br>
<br>
I got a question that I have not found a solution despite tinkering<br>
with it and googling for weeks. Would like to share it here and hopes<br>
someone could have a suggestion/solution or just a confirmation this<br>
may not be possible<br>
<br>
I would like to move some users to google services through a postini<br>
application called "Google Apps Directory Sync". This application only<br>
supports MD5 and SHA-1. It happen though openLDAP does not hash the<br>
password as either MD5 or SHA-1 and I am therefore getting an error<br>
"InvalidHashDigestLength" when I run the postini application.<br>
<br>
What I have been looking for is a mean of converting the existing<br>
password to SHA-1 and I have not been successful. Any pointer advice<br>
where I can start?<br>
<br>
Regards,<br>
<br>
William<br>
<font color="#888888">--<br>
The Toronto Linux Users Group. Meetings: <a href="http://gtalug.org/" target="_blank">http://gtalug.org/</a><br>
TLUG requests: Linux topics, No HTML, wrap text below 80 columns<br>
How to UNSUBSCRIBE: <a href="http://gtalug.org/wiki/Mailing_lists" target="_blank">http://gtalug.org/wiki/Mailing_lists</a><br>
</font></blockquote></div><br></div>