Reload Attribute Info
Compare this Object with another
Add New Attribute
Add Attribute Element to an Array
Remove Attribute
Show only Attributes that have Values
Show Friendly Object Names
Show Distinguished Name in Novell Notation
Show Hex Output for Hex Values
Show Multivalued Attributes
Set Attribute List Filter
Show Attribute Names and ValuesThis editor is used to show, edit or create LDAP password attributes:
In the top area of this dialog, you see the distinguished name and type icon for the object whose attribute your are editing. In the line beneath, the attribute name is shown.
Passwords are often stored in LDAP systems according to the rules outlined in RFC 2307 'An Approach for Using LDAP as a Network Information Service'. This document describes among other things how password can be stored in an LDAP attribute. Most generic LDAP directories like OpenLDAP, iPlanet, 389 Directory Server or DirX uses this password methods, only Active Directory uses other proprietary mechanisms to handle password information.
Passwords should never be stored in an attribute in clear text - in fact, most generic LDAP directories store an hash value of the password - in other words, a kind of encryption. Normally it should prevent any user who can read this value to re-calculate the original password, but it allows to check a password entered by the user in an authentication process.
Depending on the directory server, several different hash algorithms could be used. According to RFC 2307, the syntax of the hash value has to be '{HashAlgorithm}Hashvalue'. Only a few hash algorithms are used without indicating the algorithm name in curly brackets.
The LEX password editor
can calculate hash values for you, if you want to set a new password for an object. You just have to enter the password in the New password text box. When you re-enter the same password in the Confirm password text box, the regarding hash value is calculated and shown in the Password value box.
Please note that not all of these algorithms are supported by all LDAP servers. If you use an algorithm which indicated in the hash value, you can use the In Uppercase option to choose how the algorithm label should be inserted. Oddly enough, some LDAP server enforces the label to be upper case, although the RFC document specify this to be in lower case.
Many hash algorithms can be made stronger by adding a random value (the 'salt') to the original initial data which has to be encrypted/hashed. This additional value prevents the easy re-calculation of the initial data from the hash value, so it generally makes an hash algorithm stronger.
If you use a salted password hash algorithm like SMD5, SSHA, SSHA-256, SSHA-384 or SSHA-512, LEX generates a randomized salt value for each hash calculation. You cannot set the salt value manually, but you can decide how long this value should be. Just open the application option Tools - Options - Attribute Syntaxes for this:
The default salt length used by LEX is 8 bytes.
If you opened a userPassword attribute with the password editor dialog, the regarding data is basically handled as binary data by the LDAP directory. You can display and edit the password data in it's binary form if you want: Just press on the Raw label in the bottom left corner of the dialog. The editor is switched to an binary editor then:
If a password hash value is stored in an LDAP attribute, you normally cannot determine any more what the real password was. If you want to check if a hash value found in the directory corresponds to a certain password string, you can do the following:
For the use of the password editor, LEX evaluate the attribute's name:
The password editor which assumes that the password attribute is basically a binary value is used whenever the attribute userPassword is accessed.
The password editor which assumes that the password attribute is basically a string value is used whenever the samba attributes sambaLMPassword, lmPassword, sambaNTPassword or ntPassword are accessed.
