0

I am looking for a way to migrate a huge Synapse home server database to OpenLDAP without resetting the users' passwords. Migration to LDAP is necessary as we would like to integrate all our online services into each other

Therefore, I am looking for a way to make OpenLDAP understand Synapse's password hashes.

Synapses hashing algorithm is explained here:

pw = unicodedata.normalize("NFKC", password)

hashed = bcrypt.hashpw(
    pw.encode('utf8') + password_pepper.encode("utf8"),
    bcrypt.gensalt(bcrypt_rounds),
).decode('ascii')

Is it possible to implement such a hashing on OpenLDAP or any other open source LDAP server?

1

If bcrypt is a valid algorithm for the underlying system it should work as part of OpenLDAP's CRYPT password storage scheme.

If for instance your existing password hashes look like $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy you should be able to set the userPassword attribute OpenLDAP to {CRYPT}$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy and then authenticate.
(If you're doing this on the commandline make sure that the $text isn't interpreted as a shell variable before being input into the database.)

2
  • They are $2b$12$...hash... but otherwise this ought to work, at least on a modern Linux system. – Michael Hampton Feb 13 at 23:21
  • I am given the following error by OpenLDAP when checking the password: Unrecognized error number: 8192: crypt(): Supplied salt is not valid for DES. Possible bug in provided salt format. – TheOneWithTheBraid Feb 16 at 6:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.