Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add option 'modPassPlain' to send plaintext password updates to LDAP server #3634

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

spike77453
Copy link

This adds an additional option modPassPlain to the authldap plugin. Sending a password update to an LDAP server in plaintext is useful is a few cases:

  • The hashing algorithm and/or format is not available in dokuwiki (e.g. RedHat's pbkdf2_sha256 format, the default for 389ds and RHDS)
  • A password policy is enabled on the server. This can't be enforced when sending hashed passwords
  • Sending hashed passwords is disabled or only available to privileged accounts (password managers, directory managers) on the LDAP server (e.g. nsslapd-allow-hashed-passwords is off per default on 389ds and RHDS). Using plaintext passwords allows binding with a service account or as user with less privileges
  • The number of rounds is (e.g. for pbkdf2_sha256) is either unknown or cumbersome to manage in dokuwiki (e.g. 389ds dynamically sets the number of rounds depending on hardware capabilities)

This obviously should only be used via a secure or private communication channel (ldaps, starttls, ldapi).

@spike77453 spike77453 force-pushed the feature_add-plaintext-password-update-option branch from ef9d9c5 to ceac443 Compare June 28, 2022 01:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants