Error verifying SHA Password

[emanuel braga <em...@hotmail.com>]

Hi,

I'm developing an application that uses ApacheDS as authentication service. I've installed ApacheDS, Apache Directory Studio and I've included Apache LDAP API in my Java project.

I've already implemented the connection and simple bind with password in plain text. However I want to implement the bind process with encrypted (SHA, for example) password. With Apache Directory Studio, I've changed password (stored as SHA) with no problems.
The problem is when I try to process bind with SHA password (plain text password is 'test'):

    connection.bind( "ou=example, dc=com", "{SHA}qUqP5cyxm6YcTAhz05Hph5gvu9M=" );

I have the same problem when I try to use the verification process in Apache Directory Studio. Even if I copy "Current password" field and past it in "Verify password" field (with {SHA} tag), it does not work.

I've only found information about this process in http://directory.apache.org/api/five-minutes-tutorial.html.
How do I can implement binding process with SHA passwords?
Thanks in advance.
Regards.

------
Emanuel Braga
 		 	   		  

Re: Error verifying SHA Password

[Emmanuel Lécharny <el...@gmail.com>]

Le 4/10/13 5:12 PM, emanuel braga a écrit :
> Hi,
>
> I'm developing an application that uses ApacheDS as authentication service. I've installed ApacheDS, Apache Directory Studio and I've included Apache LDAP API in my Java project.
>
> I've already implemented the connection and simple bind with password in plain text. However I want to implement the bind process with encrypted (SHA, for example) password. With Apache Directory Studio, I've changed password (stored as SHA) with no problems.
> The problem is when I try to process bind with SHA password (plain text password is 'test'):
>
>     connection.bind( "ou=example, dc=com", "{SHA}qUqP5cyxm6YcTAhz05Hph5gvu9M=" );

You should *not* submit the hashed password, but the real password. It
makes no sense to send an hashed password to the server.

The way it works is that the server will get your password, take the
user's userPassword content, grab the hash algorithm from it, and hash
the provided password with the same algorithm, then compare it with the
stored hash value.

The reason passwords are hashed o the server is just to forbid anyone
getting access to the server to know what are the passwords. It does not
protect you against a MITM attack.



-- 
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com