Subject: RE: Password sync question

From: "Paul Leach" <[email-masked]>
Date: Wed, 12 Sep 2001 09:27:14 -0700

> -----Original Message-----
> From: Tim Bass [mailto:[email-masked]] 
> Sent: Wednesday, September 12, 2001 7:21 AM
> To: Nicolas Williams; Matt Crawford; Boza, Tom
> Cc: [email-masked]
> Subject: Re: Password sync question
> 
> 
> I don't think people replying to this thread have had a 
> chance to view the internals of MS Active Directory and how 
> the manage user password in the AD environment.
> 
> According to MS, it is not possible for any non-MS product to
> read or write passwords stored in AD.

This is not true -- using LDAP (RFC 2589) passwords can be _written_; we
require that such writes be done over SSL, since they contain the
cleartext password. Without modifying the AD code, it is not possible to
_read_ passwords or password derivatives (hashes).

Paul

---

From: "Tim Bass" <[email-masked]>
Date: Wed, 12 Sep 2001 12:47:43 -0400

Paul,

Then, if I interpret what you are saying correctly,  a non-MS LDAP
_write_ (with SSL, etc.) to a W2K domain controller/AD  will permit the
non-MS LDAP process to change W2K user  (NOS) passwords?

Is this correct?

Finest Regards, Tim

www.silkroad.com

----- Original Message -----
From: "Paul Leach" <[email-masked]>
To: "Tim Bass" <[email-masked]>; "Nicolas Williams"
<[email-masked]>; "Matt Crawford" <[email-masked]>; "Boza, Tom"
<[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, September 12, 2001 12:27 PM
Subject: RE: Password sync question