Is it possible to migrate away from ActiveDirectory?

Question

We're considering storing authentication data (username + password) in ActiveDirectory for a new product platform at my company. We're not 100% sure AD is the right long-term solution for us, but there is a team ready and willing to support it now so there is appeal to using it.

However, I'm concerned that if we decide to migrate away from it (even to something simple, like MySQL + a REST interface), we won't be able to retain the passwords for existing users. I do not want to have to ask our customers to change their password down the road simply because our backend changed.

So my question is this: is the hashing algorithm (including salt!) that AD uses documented and predictable? I am not asking to decrypt the password (I expect that is impossible). I'm simply asking if I needed to, could I extract the hashed password and reproduce the hashing algorithm so that we could move off of AD if we needed to down the road? Thanks!

UPDATE: Seems a lot of folks are misunderstanding my question. I do NOT want to decrypt any passwords. Not only is that super sketch, it's not what I'm trying to do. What I want to do is know the routine that AD uses for hashing passwords in a safe, one-way manner. Once I know that, I could easily just re-implement my own system that can authenticate users in a compatible manner. I hope that clears things up!

Answer 1

There is an option in AD for storing password with reversible encryption that you can turn on, which will allow you to decrypt the passwords. That being said, I would never ever want to pay money for a product or service that stores passwords in a reversible or portable format and I fully expect that you would fail any audits if you have this turned on.

It's irresponsible, in my opinion, to store user passwords in a reversible manner using any system. You should weigh the pros and cons and make a decision before you put any authentication mechanism into production.

Answer 2

This is quite doable, though somewhat... shady in the tools. Extracting password hashes is fairly simple, there are a variety of gray-market tools that'll do just that. Once you have those hashes, the existence of things like L0phtcrack and John the Ripper are strong evidence that the Windows password-hashing mechanism has been fully documented and is fully predictable.

Side note: part of the reason that Windows passwords are vulnerable to Rainbow Tables in a way that other password systems aren't is that Windows doesn't salt the hash.

If you can completely replicate the hashing process of Windows, you should be able to re-use the dumped hashes as the basis of an authentication system; all without actually decrypting the passwords. I just don't know of a product that does so.

Answer 3

The hashing algorithm for AD may well be predictable and repeatable, but it is not well documented. So I don't know that there is any way you're going to be able to do it that way. What I would suggest is looking into Active Directory to OpenLDAP migrations. The back end for OpenLDAP is much better documented. You could then use that as an intermediate step to implementing whatever it is you want to do.

I guess the other question I would ask is - what would cause you to move away from AD? If it's licensing costs or a general disdain for Microsoft products, build out the application differently to begin with. I would suggest that you should build it as you intend to proceed. Rearchitecting after the product has gone live will cause you nothing but heartache, regardless of how easy the migration plan appears to be.

Answer 4

sounds like a pretty tough task. maybe you can find something in the samba documentation http://www.samba.org/samba/docs/man/Samba-Developers-Guide/pwencrypt.html

you could use the same algorithm in your new backend so you can use the encrypted passwords

Answer 5

It sounds like you'd want to install something to intercept user password changes in AD and store them elsewhere. Something like passwdhk can grab the pw and do whatever you want with it (storing it unencrypted or in anything reversible is a bad idea, obviously).

You might have a look at sha1hexfltr This is used to copy AD passwords as SHA1 hashes into an attribute on the AD user (unsalted in a publicly readable AD attribute, which is a problem IMHO, angrytechnician has some ideas on that.

I dont see how a "forklift" from AD to something else would be possible (well, easy) - you'd need to have another system running simultaneously to be populated with auth data as users authenticated against AD, at the very least.