Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Received-SPF: pass (nike.apache.org: domain of ayyagarikiran@gmail.com
 designates 209.85.214.178 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:sender:date:x-google-sender-auth:message-id:subject
         :from:to:content-type;
        b=qqL64Vr/two37MzYqXpsidFCjK+3uo2aurBSKf/EQ27jpppNDxD1OVBtNmgXSsMvrh
         5xXRBhpBDaSGoF/tjejUScquiNRfJ9ZpnuNZCzeNi0VKc2tOk7UwER/tvn9PYokBhwcJ
         ADY8Ijm03EkEwDtrCvW6wopSiyyK2IOlkKo+o=
MIME-Version: 1.0
Sender: ayyagarikiran@gmail.com
Date: Sun, 31 Oct 2010 13:19:21 +0530
Message-ID: <AANLkTimYP6KoCWBRK8HMwSHX+ViBHaMJwcM98Beo34Ap@mail.gmail.com>
Subject: [ApacheDS] hashing passwords before storing
From: Kiran Ayyagari <kayyagari@apache.org>
To: Apache Directory Developers List <dev@directory.apache.org>
Content-Type: text/plain; charset=ISO-8859-1

  hello dev,

  Currently we don't have a feature to automatically hash the passwords before
  storing them, I would like to propose that we should add this feature.

  I would like to add a new interceptor to support this feature:

   1. It is easy to enable/disable without adding some more config options
       to DirectoryService
   2. We can place at the appropriate position in the interceptor chain so that
       changelog and journals will also have the same password as the DIT

  We currently support the following hashing algorithms
        SHA, SSHA, MD5, SMD5, Crypt, SHA-2 (256, 384, 512 along with their
        salted counterparts)

  Studio might need to change its 'password change' screen by adding an option
  to send the plain text password though the original password is hashed.
  (AFAIU currently studio hashes on the client side and sends)

 thoughts?
-- 
Kiran Ayyagari