Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: pass (nike.apache.org: local policy)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
  b=rb9gD+cnHl4Ys05QF8mcQRCV2w+xgcqWe5g3YdbU468Ro6axZbKK6Ku/C5pXvEYKiJbwgHCnuriqRAXvoV8WOA2N44jOfHFb2A3F7PzLImENRCK/gA3FEkavxmyVTS+YUbNjTZZsgMHhIt9TRwHHLLwOaVxMzgvL7E+6RAiW69I=;
References: <1360981315.9373.YahooMailNeo@web121506.mail.ne1.yahoo.com>
 <CABzFU-dSk8T7nB32+uuTzQjejNACqZwP-iWWXOt-pV9u=0d0tg@mail.gmail.com>
Message-ID: <1361216368.39215.YahooMailNeo@web121502.mail.ne1.yahoo.com>
Date: Mon, 18 Feb 2013 11:39:28 -0800 (PST)
From: suresh ramamurthy <suresh_renuram@yahoo.com>
Reply-To: suresh ramamurthy <suresh_renuram@yahoo.com>
Subject: Re: Can we send SHA of password as the credential for LDAP
 authentication..
To: Kiran Ayyagari <kayyagari@apache.org>,
  "users@directory.apache.org" <users@directory.apache.org>
In-Reply-To: 
 <CABzFU-dSk8T7nB32+uuTzQjejNACqZwP-iWWXOt-pV9u=0d0tg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="1319493512-1881322431-1361216368=:39215"

--1319493512-1881322431-1361216368=:39215
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

Hi Kiran,=0A=0AThank you very much for your response....=0A=0A--Suresh=0A=
=0A=0A________________________________=0A From: Kiran Ayyagari <kayyagari@a=
pache.org>=0ATo: users@directory.apache.org; suresh ramamurthy <suresh_renu=
ram@yahoo.com> =0ASent: Friday, February 15, 2013 10:30 PM=0ASubject: Re: C=
an we send SHA of password as the credential for LDAP authentication..=0A =
=0A=0A=0A=0A=0AOn Sat, Feb 16, 2013 at 7:51 AM, suresh ramamurthy <suresh_r=
enuram@yahoo.com> wrote:=0A=0AHi..=0A>=0A>We have a requirement to not send=
 clear text as the credential for LDAP bind operation.=A0=0A>=0A>So, we sto=
re SHA of the password in the Apache DS LDAP server and we would like to se=
nd the SHA of the password from client as=0A>the user credential for LDAP a=
uthentication. For example, we can set the password as {SHA}blah..blah...=
=0A>=0A>Is it possible to configure Apache DS to ignore hash conversion of =
the input password and just compare the password with LDAP DB?=0A>=0A>I goo=
gled for couple of days and I also looked in the Apache DS code and found t=
hat during bind operation, input password is hashed=0A>using the algorithm =
stored along with the password in LDAP DB and then the result is compared.=
=A0=0A>=0A>Can any one please shed light on this and let me=A0know if we ca=
n send SHA of the password from client instead of the real password for LDA=
P authentication.=A0=0A>Also, is this a valid approach or sending clear pas=
sword from client is the only approach(assuming ssl is enabled..)=0A>=0A>=
=0Athis is not the correct way to perform bind operation with the server, u=
se startTLS with clear text password=0A=0AThanks,=0A>Suresh=0A=0A=0A-- =0AK=
iran Ayyagari=0Ahttp://keydap.com 
--1319493512-1881322431-1361216368=:39215--