Is there any command/extension available to update the "userPassword" attribute from a user object in LDAP server to SSHA hashed passsword from plain text?

we found that users in LADP are stored in plain text. Once we enable the password policy new users's password are stored in SSHA. How to migrate existing users's plain text password to SSHA password?

Update on Version - OS : CentOS release 6.6 - 64 bit

  • OpenLdap version : openldap-servers-2.4.39

  • Cloud : AWS

  • Instance Type : r3.xlarge

  • Two LDAP Servers


The OpenLDAP documentation provides some sample code in the FAQ which you can use to create custom scripts in your favourite scripting language to convert clear text passwords to SSHA.
Note: Please don't use the same salt for all your users.

Export (parts of) your directory to directory to LDIF format with slapcat and script away!

For a small number of clear text passwords you could simply generate an LDIF to update them:

dn: cn=Alice, ou=Users, o=example, c=com
changetype: modify 
replace: userPassword 
userPassword: {SSHA}xxxxxxxxxxxxxxxx 

dn: cn=Bob, ou=Users, o=example, c=com
changetype: modify 
replace: userPassword 
userPassword: {SSHA}abcabcabcbacbabcabc 

You might want to spin up a test server and benchmark how long updating with an LDIF takes. AFAIK there are no indexes on the password field so performance might be sufficient for your purposes, but typically going through the LDAP interface is relatively slow (and slower still when many indexes have to be updated as well). One of the advantages is that using an LDIF will follow your replication structure.

Typically modifying the database in it's off-line state is much faster. Again make an export with slapcat, convert the clear text userPassword: fields in the resulting LDIF and use slappadd to reload it. Maybe with -q and -s switches. How well that mixes with (multi-master) replication, depends a bit on your intended approach.

This Q&A might be of interest in deciding on an approach as well.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.