We're considering storing authentication data (username + password) in ActiveDirectory for a new product platform at my company. We're not 100% sure AD is the right long-term solution for us, but there is a team ready and willing to support it now so there is appeal to using it.
However, I'm concerned that if we decide to migrate away from it (even to something simple, like MySQL + a REST interface), we won't be able to retain the passwords for existing users. I do not want to have to ask our customers to change their password down the road simply because our backend changed.
So my question is this: is the hashing algorithm (including salt!) that AD uses documented and predictable? I am not asking to decrypt the password (I expect that is impossible). I'm simply asking if I needed to, could I extract the hashed password and reproduce the hashing algorithm so that we could move off of AD if we needed to down the road? Thanks!
UPDATE: Seems a lot of folks are misunderstanding my question. I do NOT want to decrypt any passwords. Not only is that super sketch, it's not what I'm trying to do. What I want to do is know the routine that AD uses for hashing passwords in a safe, one-way manner. Once I know that, I could easily just re-implement my own system that can authenticate users in a compatible manner. I hope that clears things up!