Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-2679

Crowd + Apache Directory Server connector submitting changed passwords in plaintext

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: High High
    • 2.4.2
    • 2.3.1, 2.3.2
    • None
    • None

    • Using Crowd and a Apache Directory server

      Setting up Crowd and a Apache directory server, if you try to modify the password from a user and save it, Crowd stores it in Apache as plaintext.

      See the screenshot with a test case.

        1. plainText.jpg
          plainText.jpg
          62 kB

          Form Name

            [CWD-2679] Crowd + Apache Directory Server connector submitting changed passwords in plaintext

            joe added a comment -

            The ApacheDS example sells them short - they also support SSHA, which is better and also our default for OpenLDAP. I'll switch ApacheDS to the same behaviour as OpenLDAP (let encoding be set in the UI, make SSHA the default, use a factory).

            joe added a comment - The ApacheDS example sells them short - they also support SSHA, which is better and also our default for OpenLDAP. I'll switch ApacheDS to the same behaviour as OpenLDAP (let encoding be set in the UI, make SSHA the default, use a factory).

            Justin Koke added a comment - - edited

            We should be using the encryption algorithm specified for the directory, as used by the OpenLDAP implementation.

            Justin Koke added a comment - - edited We should be using the encryption algorithm specified for the directory, as used by the OpenLDAP implementation.

            joe added a comment -

            From Apache DS - Passwords stored one-way encrypted, ApacheDS supports setting the password as a SHA-1 hash.

            We can switch to using that when the password is set to prevent storing plaintext in the directory

            joe added a comment - From Apache DS - Passwords stored one-way encrypted , ApacheDS supports setting the password as a SHA-1 hash. We can switch to using that when the password is set to prevent storing plaintext in the directory

              jwalton joe
              rgadami Rodrigo Girardi Adami
              Affected customers:
              1 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: