1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
|
so, in your entry, an attribute like this could be specified:
userPassword: {SHA}fDYHuOYbzxlE6ehQOmYPIfS28/E=
but when you do a slapcat or ldapsearch and the output is in LDIF format, the userpassword will be base_64 encoded, and it will look like this:
userPassword:: e1NIQX1mRFlIdU9ZYnp4bEU2ZWhRT21ZUElmUzI4L0U9
Confused yet ?
Now enter PHP (< 5). You would like to generate a {SHA} password from a cleartext password that was entered in a FORM by a user, which is held in $pass. It would be easy to do:
$userpassword = "{SHA}" . sha1( $pass );
but that will generate:
{SHA}7c3607b8e61bcf1944e9e8503a660f21f4b6f3f1
and altough that looks nice, it won't work. That's because the PHP sha1() function delivers a Hex encoded string. In PHP >= 5 you can set a boolean, to omit that:
$userpassword = "{SHA}" . sha1( $pass, TRUE );
but in PHP < 5 you need to do this:
$userpassword = "{SHA}" . pack( "H*", sha1( $pass ) );
this will generate:
something very ugly that I can't represent here, since it is binary.
now to avoid putting the binary stuff into the directory, you need to base_64 encode it, like this:
$userpassword = "{SHA}" . base64_encode( pack( "H*", sha1( $pass ) ) );
this will, finally, generate
{SHA}fDYHuOYbzxlE6ehQOmYPIfS28/E= |
Comparaison userpassword - LDAP
Répondre avec citation
)
Partager