In my current LDAP schema I have an objectclass (let's call it group) that has 2 attributes that extend userpassword. Like this:

attributeType ( groupAttributes:12 NAME 'groupPassword1'        
    SUP userPassword

attributeType ( groupAttributes:13 NAME 'groupPassword2'        
        SUP userPassword
        SINGLE-VALUE )

group extends organisation so already has a userpassword attribute. If I use that to enter a new group using PHPLDAPAdmin it uses SSHA (by default) and encrypts/hashes the password I entered. But the passwords I entered for groupPassword1 en groupPassword2 don't get encrypted.

Is there a way to make it so that those attributes are encrypted too?


I've just resolved trouble like this by creating new objects with the auxiliary class simpleSecurityObject (I've used organizationalRole as the structural class, but anything will do) as children of the object that needs more than one class of passwords. Note however that userPassword is a multivalued attribute and can contain several values.

  • cn=group,ou=Groups,...
    • cn=extrapassword,cn=group,ou=Groups,...
    • cn=additionalpassword,cn=group,ou=Groups,...


dn: cn=group,ou=Groups,...
objectClass: ...
userPassword: password1
userPassword: password2
  • Could you work out further how this would work exactly? I can't find much info on simpleSecurityObject. Is it something like this? objectclass ( groupObjectclasses:1 NAME 'groupWithPW' SUP group STRUCTURAL ) Then I have one password, but I need two? Or do I just repeat this step and make another objectclass that does SUP groupWithPW?
    – HDW
    Aug 30 '12 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.