Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We'd like to switch Identity Provider (and Web Access Manager), and also the user directory we use, but would like to do so without users needing to change their password.

We currently have the SSHA of the passwords.

I'm expecting to write code to perform the migration. I don't mind how complex the code has to be, rather my concern is whether such a migration is possible at all.

MS Active Directory would be our preferred user store, but I believe that it can not have new users set up in it with a particular password hash. Is that correct?

What user directory stores can be populated with users already set up with a SSHA password?

What Identity Provider and Access Management products work with those stores?

share|improve this question

Novell's eDirectory supports pre-hashed passwords. There are actually three different passwords available in eDirectory. The RSA Key paired legacy password, the Simple Password and Universal Password.

Simple Password can take a SHA1 hashed password and allow users to login. One the first login, the policy can be set to then copy that password to Universal Password, at which point the user is migrated to the more proper and modern password store.

Novell Identity Manager and Access Manager provide excellent Identity synchronization, provisioning, and Access management to eDirectory.

Of course, you could use eDirectory with Simple passwords, and once the users login with Simple password synchronize that change event to Active Directory.

share|improve this answer
Thanks for the info. Can it take a salted SHA1 password? – Stephen Denne Jun 28 '10 at 22:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.