[phpldapadmin] [ phpldapadmin-Bugs-1925203 ] Sun Java System DS compatible SSHA

Bugs item #1925203, was opened at 2008-03-26 01:04
Message generated for change (Settings changed) made by wurley
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=1925203&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: 1.1.x
Status: Closed
>Resolution: Accepted
Priority: 5
Private: No
Submitted By: Oleg Smirnov (oleg_smirnov)
Assigned to: Nobody/Anonymous (nobody)
Summary: Sun Java System DS compatible SSHA

Initial Comment:
phpLDAPadmin 1.1.0.5 unable to check passwords stored in Sun Java System DS 5.2 (formely Sun One DS) SSHA format. The attached patch attempts to correct its behavior.

----------------------------------------------------------------------

Comment By: Deon George (wurley)
Date: 2008-12-03 07:58

Message:
Now it makes sense! OK, patched and in CVS (BRANCH-1_1_0)

lib/functions 1.303.2.37

----------------------------------------------------------------------

Comment By: Oleg Smirnov (oleg_smirnov)
Date: 2008-12-03 04:17

Message:
Here is my dump:

Array
(
    [salt] => W&
    [new_hash] => Ui0olnvEIHHzItez0HA26KHYwe0YHlcm
    [osalt] => �q	cW&
    [ohash] => ��6�}�̯Zo.~0`�
a��
    [nhash] => ��6�}�̯Zo.~0`�
a��
    [crypted] => xNY2s32UzK9aby5+HDBgkwph/eSpcQljGB5XJg==
    [hash] => ��6�}�̯Zo.~0`�
a��q	cW&
    [strlen] => 28
)

The user's password is "123", stored in LDAP as
"{SSHA}xNY2s32UzK9aby5+HDBgkwph/eSpcQljGB5XJg==". Notice the difference in
the salt's length: OpenLDAP uses 4 bytes, but Sun DS uses 8.

So, basically, my patch can be reduced to fewer lines:

--- functions.php.bak	Tue Dec  2 19:15:32 2008
+++ functions.php	Tue Dec  2 19:16:03 2008
@@ -2033,7 +2033,7 @@
 			// check php mhash support before using it
 			if( function_exists( 'mhash' ) ) {
 				$hash = base64_decode($cryptedpassword);
-				$salt = substr($hash, -4);
+				$salt = substr($hash, 20);
 				$new_hash = base64_encode( mhash( MHASH_SHA1,
$plainpassword.$salt).$salt );
 
 				if( strcmp( $cryptedpassword, $new_hash ) == 0 )

It's seems to be compatible with both LDAPs.

----------------------------------------------------------------------

Comment By: Deon George (wurley)
Date: 2008-12-01 16:24

Message:
I dont have Sun DS :)

I have tested SSHA to an openldap server.

Actually, I've looked in more detail in your patch, and it does exactly
the same as before (just a differnet way) - so why isnt it working for you?

The old code, picked out the salt, re-generated the password from the user
provided details (using the salt), base64 encoded, and compared that to
text that would have been in LDAP.

Your patch, picked out the salt, re-generated the password, and compares
that to unsalted (binary) password (extracted from the entry in LDAP). The
only difference is base64_encoding and the (string) comparison.

Can you enable the old code, with your patch and add (after the evaluation
of nhash):
debug_dump(
array('salt'=>$salt,
'new_hash'=>$new_hash,
'osalt'=>$osalt,
'ohash'=>$ohash,
'nhash'=>$nhash,
'crypted'=>$cryptedpassword,
'hash'=>$hash,
'strlen'=>strlen($hash)),1);

Then do your password compare popup with the correct password. 

It should show (even though some will be binary):
* salt and osalt are the same
* ohash and nhash ar e the same
* crypted and new_hash are the same
* hash is the same as nhash or ohash with osalt or salt on the end.

What is different?

EG:
Array
(
    [salt] => U3�
    [new_hash] => Jv8eCLhIzJcuBOw9daXrNgBcvvBVGjON
    [osalt] => U3�
    [ohash] => &��H̗.�=u��6�\��
    [nhash] => &��H̗.�=u��6�\��
    [crypted] => Jv8eCLhIzJcuBOw9daXrNgBcvvBVGjON
    [hash] => &��H̗.�=u��6�\��U3�
    [strlen] => 24
)


----------------------------------------------------------------------

Comment By: Oleg Smirnov (oleg_smirnov)
Date: 2008-12-01 04:58

Message:
Could you tell me what version of Sun DS are you using?

----------------------------------------------------------------------

Comment By: Deon George (wurley)
Date: 2008-11-28 21:23

Message:
I havent applied your patch.

I've tested SSHA password with PLA and they work ?

IE: I created a password with slappasswd, and with that password I was
able to bind to LDAP natively, login to LDAP as well as check the password
with the password checker.

So I'm not sure why this patch is needed? Let me know if you think it
should be included - I need to know what is wrong with the current code...

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=1925203&group_id=61828

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/