Re: DBIS - new IETF drafts

Luke Howard wrote:
>>> Every LDAP-aware client system that I have worked with can use the
>>> bind operation as a means to validate passwords, so the only
>>> possible excuse for exporting hashes is temporary support of
>>> migrating systems. If you only allow the export of hashes that are
>>> actually needed by the old non-LDAP systems then at least you are
>>> not making matters worse than they were before the migration.
>>
>> Ok, so I posed this question just now, but can all LDAP servers you can think of authentication bind operations using CRYPT-style passwords?  If it can be done server-side there'll be no problem here and we need never expose the hashes to clients.
> 
> Active Directory cannot.

Right.

But it's not a real operational issue because if you already have an AD domain
with a big user base they already have passwords set for Windows anyway.

Ciao, Michael.

_______________________________________________
Ldapext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ldapext