1

Is it possible to inform the user of slightly more than just "constraint violation" when they attempt to change their password?

Something like "password must be 7 or more characters", instead of leaving them guessing?

OpenDJ

3
  • Do you have the source code to whatever program is generating this "constraint violation" message? (It would help a lot if you told us what program that was.) Aug 24 '12 at 13:01
  • My apologies, it's OpenDJ, and yes, I have the source if I need it.
    – Ivy
    Aug 24 '12 at 13:06
  • So change the error message. ;) Aug 24 '12 at 13:11
1

What is your LDAP server ?

Err 19, LDAP_CONSTRAINT_VIOLATION - Indicates that the attribute value specified in a modify, add, or modify DN operation violates constraints placed on the attribute. The constraint can be one of size or content (string only, no binary).

Most of the LDAP server already provide enough information about missing piece in password or attribute. Could you check 389 Directory server or RHDS. A sample from 389-ds is

[17/Aug/2012:22:24:59 +0000] conn=85 op=14 RESULT err=19 tag=103 nentries=0 etime=0
[17/Aug/2012:22:24:59 +0000] conn=85 op=14 MOD dn="uid=redhat,ou=Users,dc=example,dc=com", within password minimum age
0

You need to change the code to use the LDAP extended password modify request, which provides detailed error codes in its response.

0

Old question, but we had this exact issue today with an external self-service password web app. Turns out the SSP web app was SSHA-ing the password prior to it reaching 389-DS, thus 389-DS was receiving a hash.

The SSP web app needs to leave the password clear and let 389-DS encrypt it itself on write. (The SSP web app uses TLS 1.2 with AES-256 to communicate to LDAP anyway, so the clear password is as secure as most HTTPS websites in transit.)

-1

It is not recommended to provide a more descriptive message. More descriptive text in an LDAP response would simply aid an attacker.

1
  • 1
    An attacker already knows the password he changes. What else to hide? May 23 '16 at 1:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.