I am tying to make openldap to store all userPassword attributes hashed with {SSHA} alogorithm. I managed to configure frontend db with olcPasswordHash :

dn: olcDatabase={-1}frontend
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: {-1}frontend
structuralObjectClass: olcDatabaseConfig
creatorsName: cn=config
createTimestamp: 20181218082812Z
olcPasswordHash: {SSHA}     <------------configured with ldapmodify
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

But even after slapd service restart new password modifications/creations (I use ldapvi to edit ldifs) are still in cleartext and nothing wrong in the ldap.log. Please note here that If I choose to write the password in encrypted format, (with {SSHA} tag in front) it is working normaly. The problem is that when I write it in cleartext it is not encrypted automaticaly after I save and exit.

Any ideas?


If you want to let slapd generate a password hash from a clear-text userPassword value in a modify request then you have to configure slapo-ppolicy with directive ppolicy_hash_cleartext.

  • Indeed! That solved the mistery :) Thank you ! – Manos K Jun 4 at 10:43

This setting only applies when you're using the RFC 3062 extended operation, i.e. using ldappasswd. Just editing entries with normal LDIF operations won't work. If you want to seed entries with an encrypted value, use slappasswd to generate the hash.

Edit: Looking specifically at the ldapvi documentation, it appears to use an LDIF-like format with some extensions. To get attributes encrypted, you need to specify the attribute using the form:

userPassword:ssha mysecret

I don't think the olcPasswordHash setting has any bearing on that functionality.

  • I can seed encrypted passwords without a problem. However I remember in the past using ldapvi in other ldap servers and even if I was writing in cleartext, after saving the ldif was automaticaly stored as encryped. Maybe there was a diffrent handling from ldapvi, I don't know. Thanks for your answer anyway! – Manos K May 29 at 8:39
  • Yes I am aware of these extensions, but I remember the ldap I used in the past had no need of those in ldapvi. – Manos K Jun 3 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.