Subject: Re: Schema: encrypted 8-bit userPassword and SASLprep

From: Hallvard B Furuseth <[email-masked]>
Date: Fri, 12 Sep 2003 16:12:43 +0200

Jim Sermersheim writes:
><Michael>
>> Note that hashed passwords are non-standard anyway... ;-)
> 
><Halvard>
>> No, they are irrelevant to the standard:
> 
> Halvard, if you are still talking about userPassword, see Section 2.41
> in
> http://ietf.org/internet-drafts/draft-ietf-ldapbis-user-schema-06.txt:
> "Passwords are stored using an Octet String syntax and are not
> encrypted. "

Oh my.  I didn't notice that.  Or maybe I did, but just didn't believe
what I saw:-)

Please, could we remove this requirement?  This means people can't bind
to LDAP with their Unix or Windows passwords.  Our security people would
never allow us to run an LDAP server conforming to this requirement, and
I doubt they are alone in that.

-- 
Hallvard

---

From: Hallvard B Furuseth <[email-masked]>
Date: Fri, 12 Sep 2003 17:00:46 +0200

I wrote:
> Please, could we remove this requirement?  (...)

I should have calmed down before I wrote that:-)

Another solution, of course, is for the server to store the encrypted
passwords elsewhere.

I'd be interested to know what today's servers do, though.  Is the
quoted sentence above at odds with current practice?  If so, I still
suggest the sentence is removed.

All I know is that OpenLDAP allows encrypted as well as passwords
passwords in userPassword.

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 12 Sep 2003 08:53:55 -0700

At 08:00 AM 9/12/2003, Hallvard B Furuseth wrote:
>If so, I still suggest the sentence is removed.

I note that removal of this sentence:
   Passwords are stored using an Octet String syntax and are not
   encrypted.

has been previously discussed on the list and consensus established
that it should remain.  I suggest we confine our discussion as
to whether or not clients storing textual strings in the
userPassword should prepare them before or not.

Kurt, LDAPbis co-chair