Docker-openldap: [QUESTION] How to enable Hash Passwords in OpenLDAP

[xd34]

Hi All

Can you help me, I need to enable password hashing at openLDAP level
I need to have situation where clients send password in PLAIN_TEXT and openLDAP store this as {SSHA}

I would like to enable this:
http://xacmlinfo.org/2015/06/25/enable-hash-passwords-in-openldap/

but I do not know how to do this during container configuration

[xd34]

Solved:

Load the ppolicy module

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: ppolicy

Enable the overlay and its hash_cleartext policy

dn: olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: {2}ppolicy
olcPPolicyHashCleartext: TRUE

[Ryonez]

While this does do it, it fails if you try to do it normally, like with:
ldapadd -x -D cn=admin,dc=example,dc=com -W -f add_ppolicy.ldif

Instead, you have to use this:
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f add_ppolicy.ldif

This is due to the cn=config having different authentication going on. I didn't know how to change it, but was able to get this command by poking around in this guide.

Thank you @xd34, you saved me so much extra trouble trying to sort this out. I'll suggest though, as you've solved this, to close the issue maybe. Cheers.

[Vickey-Wu]

Solved:

Load the ppolicy module

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: ppolicy

Enable the overlay and its hash_cleartext policy

dn: olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: {2}ppolicy
olcPPolicyHashCleartext: TRUE

@xd34 hello, buddy, are load module and overlay module write in different file? and what path in container do they place in? i use docker-compose, so i wanna know what place in container are they mount. And is there need other operation after mount? please help, thanks a lot!

[Vickey-Wu]

Solved:

Load the ppolicy module

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: ppolicy

Enable the overlay and its hash_cleartext policy

dn: olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: {2}ppolicy
olcPPolicyHashCleartext: TRUE

@xd34 hello, buddy, are load module and overlay module write in different file? and what path in container do they place in? i use docker-compose, so i wanna know what place in container are they mount. And is there need other operation after mount? please help, thanks a lot!

solved

1. two module write in different file.
2. we can mount file in container anywhere
3. get in openldap container and use follow command to configure

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f path_you_mount_in_container/whaterver.ldif

load-ppolicy.ldif

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: ppolicy

overlady-ppolicy.ldif

dn: olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: {2}ppolicy
olcPPolicyHashCleartext: TRUE

log

root@ubuntu:/etc/ldap/slapd.d# ldapadd -Q -Y EXTERNAL -H ldapi:/// -f load-ppolicy.ldif 
modifying entry "cn=module{0},cn=config"

root@ubuntu:/etc/ldap/slapd.d# ldapadd -Q -Y EXTERNAL -H ldapi:/// -f overlady-ppolicy.ldif 
adding new entry "olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config"

root@ubuntu:/etc/ldap/slapd.d#