Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any command/extension available to update the "userPassword" attribute from a user object in LDAP server to SSHA hashed passsword from plain text?

we found that users in LADP are stored in plain text. Once we enable the password policy new users's password are stored in SSHA. How to migrate existing users's plain text password to SSHA password?

Update on Version - OS : CentOS release 6.6 - 64 bit

  • OpenLdap version : openldap-servers-2.4.39

  • Cloud : AWS

  • Instance Type : r3.xlarge

  • Two LDAP Servers

share|improve this question
updated the question. – Dinesh Kumar Sarangapani Aug 3 '15 at 11:50

The OpenLDAP documentation provides some sample code in the FAQ which you can use to create custom scripts in your favourite scripting language to convert clear text passwords to SSHA.
Note: Please don't use the same salt for all your users.

Export (parts of) your directory to directory to LDIF format with slapcat and script away!

For a small number of clear text passwords you could simply generate an LDIF to update them:

dn: cn=Alice, ou=Users, o=example, c=com
changetype: modify 
replace: userPassword 
userPassword: {SSHA}xxxxxxxxxxxxxxxx 

dn: cn=Bob, ou=Users, o=example, c=com
changetype: modify 
replace: userPassword 
userPassword: {SSHA}abcabcabcbacbabcabc 

You might want to spin up a test server and benchmark how long updating with an LDIF takes. AFAIK there are no indexes on the password field so performance might be sufficient for your purposes, but typically going through the LDAP interface is relatively slow (and slower still when many indexes have to be updated as well). One of the advantages is that using an LDIF will follow your replication structure.

Typically modifying the database in it's off-line state is much faster. Again make an export with slapcat, convert the clear text userPassword: fields in the resulting LDIF and use slappadd to reload it. Maybe with -q and -s switches. How well that mixes with (multi-master) replication, depends a bit on your intended approach.

This Q&A might be of interest in deciding on an approach as well.

share|improve this answer
Thanks @HBruijn. – Dinesh Kumar Sarangapani Aug 4 '15 at 4:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.