Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my current LDAP schema I have an objectclass (let's call it group) that has 2 attributes that extend userpassword. Like this:

attributeType ( groupAttributes:12 NAME 'groupPassword1'        
    SUP userPassword

attributeType ( groupAttributes:13 NAME 'groupPassword2'        
        SUP userPassword
        SINGLE-VALUE )

group extends organisation so already has a userpassword attribute. If I use that to enter a new group using PHPLDAPAdmin it uses SSHA (by default) and encrypts/hashes the password I entered. But the passwords I entered for groupPassword1 en groupPassword2 don't get encrypted.

Is there a way to make it so that those attributes are encrypted too?

share|improve this question
up vote 2 down vote accepted

I've just resolved trouble like this by creating new objects with the auxiliary class simpleSecurityObject (I've used organizationalRole as the structural class, but anything will do) as children of the object that needs more than one class of passwords. Note however that userPassword is a multivalued attribute and can contain several values.

  • cn=group,ou=Groups,...
    • cn=extrapassword,cn=group,ou=Groups,...
    • cn=additionalpassword,cn=group,ou=Groups,...


dn: cn=group,ou=Groups,...
objectClass: ...
userPassword: password1
userPassword: password2
share|improve this answer
Could you work out further how this would work exactly? I can't find much info on simpleSecurityObject. Is it something like this? objectclass ( groupObjectclasses:1 NAME 'groupWithPW' SUP group STRUCTURAL ) Then I have one password, but I need two? Or do I just repeat this step and make another objectclass that does SUP groupWithPW? – Foezjie Aug 30 '12 at 19:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.