Check LDAP password with SHA512

[David Lord]

Which of these looks right?

authenticate {
	pap
	ldap
}

authenticate {
	ldap
	pap
}

> On 28 Jan 2016, at 6:06 PM, Will W. <will at damagesinc.net> wrote:
> 
> Ok, how do I change the order in which ldap and pap are called?
> 
> On Wed, Jan 27, 2016 at 2:13 PM, Arran Cudbard-Bell <
> a.cudbardb at freeradius.org> wrote:
> 
>> 
>>> On Jan 27, 2016, at 5:08 PM, Arran Cudbard-Bell <
>> a.cudbardb at freeradius.org> wrote:
>>> 
>>> 
>>>> On Jan 27, 2016, at 4:36 PM, Will W. <will at damagesinc.net> wrote:
>>>> 
>>>> Question
>>>> With Start_TLS yes
>>>> this is enabling the Freeradius to connect to the LDAP server over a
>> TLS tunnel correct?
>>> 
>>> Yes, the connection starts off as plaintext, then the ldap client
>> requests to establish a TLS tunnel.
>>> 
>>> Map looks OK.  You need to run ldapsearch with this invocation to see if
>> the userPassword is being returned:
>>> 
>>> ldapsearch -H ldap://ldap.myhost.com:389 —ZZ x -b
>> "ou=Users,dc=myhost,dc=com" -D "uid=demouser,ou=Users,dc=myhost,dc=com" -w
>> testing123 "(objectClass=posixGroup)" userPassword
>> 
>> Here are the headers and what they map to:
>> 
>> /*
>> *      For auto-header discovery.
>> *
>> *      @note Header comparison is case insensitive.
>> */
>> static const FR_NAME_NUMBER header_names[] = {
>>        { "{clear}",            PW_CLEARTEXT_PASSWORD },
>>        { "{cleartext}",        PW_CLEARTEXT_PASSWORD },
>>        { "{md5}",              PW_MD5_PASSWORD },
>>        { "{base64_md5}",       PW_MD5_PASSWORD },
>>        { "{smd5}",             PW_SMD5_PASSWORD },
>>        { "{crypt}",            PW_CRYPT_PASSWORD },
>> #ifdef HAVE_OPENSSL_EVP_H
>>        /*
>>         *      It'd make more sense for the headers to be
>>         *      ssha2-* with SHA3 coming soon but we're at
>>         *      the mercy of directory implementors.
>>         */
>>        { "{sha2}",             PW_SHA2_PASSWORD },
>>        { "{sha224}",           PW_SHA2_PASSWORD },
>>        { "{sha256}",           PW_SHA2_PASSWORD },
>>        { "{sha384}",           PW_SHA2_PASSWORD },
>>        { "{sha512}",           PW_SHA2_PASSWORD },
>>        { "{ssha224}",          PW_SSHA2_224_PASSWORD },
>>        { "{ssha256}",          PW_SSHA2_256_PASSWORD },
>>        { "{ssha384}",          PW_SSHA2_384_PASSWORD },
>>        { "{ssha512}",          PW_SSHA2_512_PASSWORD },
>> #endif
>>        { "{sha}",              PW_SHA_PASSWORD },
>>        { "{ssha}",             PW_SSHA_PASSWORD },
>>        { "{md4}",              PW_NT_PASSWORD },
>>        { "{nt}",               PW_NT_PASSWORD },
>>        { "{nthash}",           PW_NT_PASSWORD },
>>        { "{x-nthash}",         PW_NT_PASSWORD },
>>        { "{ns-mta-md5}",       PW_NS_MTA_MD5_PASSWORD },
>>        { "{x- orcllmv}",       PW_LM_PASSWORD },
>>        { "{X- orclntv}",       PW_NT_PASSWORD },
>>        { NULL, 0 }
>> };
>> 
>> You need to call the pap module in authorize after the LDAP module in
>> order to strip the header and perform the conversion.
>> 
>> It also does a bunch of normalisation.  It could be you have the modules
>> in the wrong order, pap then ldap when you need ldap then pap.
>> 
>> -Arran
>> 
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>> 
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html