<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div>Thanks for the explanation, Quanah. Much appreciated!</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div id="x_composer_signature">
<p class="x_MsoNormal"><span style="font-size:12.001pt">--<br>
</span></p>
<p class="x_MsoAutoSig"><b style=""><span style="font-size:14.001pt">Robert G. Werner</span></b></p>
<p class="x_MsoAutoSig"><span style="font-size:14.001pt">Systems Admnistrator</span></p>
<p class="x_MsoAutoSig"><span style="font-size:14.001pt">University of California Merced,<span style="">
</span>Office of Information Techonology</span></p>
<p class="x_MsoNormal"><span style="font-size:14.001pt; font-family:Calibri,sans-serif"><a href="mailto:rwerner2@ucmerced.edu" id="LPNoLP" style="font-size:14.001pt">rwerner2@ucmerced.edu</a> |
<a href="https://it.ucmerced.edu/" id="LPNoLP" target="_BLANK" style="font-size:14.001pt">
it.ucmerced.edu</a> | <a href="tel:209.201.4386" style="font-size:14.001pt">209.201.43</a>68</span></p>
</div>
<div><br>
</div>
<div><br>
</div>
<div>-------- Original message --------</div>
<div>From: Quanah Gibson-Mount <quanah@symas.com> </div>
<div>Date: 6/5/18 5:34 PM (GMT-08:00) </div>
<div>To: Robert Werner <rwerner2@ucmerced.edu>, Dan White <dwhite@olp.net> </div>
<div>Cc: cyrus-sasl@lists.andrew.cmu.edu </div>
<div>Subject: Re: Problem using saslauthd against ldap server ... </div>
<div><br>
</div>
</div>
<font size="2"><span style="font-size:11pt;">
<div class="PlainText">--On Tuesday, June 05, 2018 11:45 PM +0000 Robert Werner <br>
<rwerner2@ucmerced.edu> wrote:<br>
<br>
> We are using the "userPassword" attribute, and the password is<br>
> encrypted. I"m not sure what the algo is. But the the thing is that<br>
> with Auth Plain and Auth Login the password is being send in clear.<br>
<br>
The userPassword attribute, by RFC, is base64 encoded (not encrypted). The <br>
reason you see "userPassword:: <value>" from an ldapsearch result (vs <br>
"userPassword: <value>") indicates that encoding is in place. You can <br>
trivially decode the value. In addition, OpenLDAP by default stores a hash <br>
of the password, not the password itself.<br>
<br>
If you decode the value, you should get something like:<br>
<br>
{SSHA}m80vEZ5rVevDAMoamCO1qKwIV/AEow8D<br>
<br>
which indicates that the password hash is using SSHA.<br>
<br>
The real issue, based on what you're describing, is that the password being <br>
sent to the ldap server to validate against the hash has been truncated for <br>
some reason.<br>
<br>
You can confirm that basic authentication against your ldap server is <br>
working via the "ldapwhoami" binary to rule out any issue on the LDAP <br>
server side.<br>
<br>
--Quanah<br>
<br>
--<br>
<br>
Quanah Gibson-Mount<br>
Product Architect<br>
Symas Corporation<br>
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:<br>
<<a href="http://www.symas.com">http://www.symas.com</a>><br>
<br>
</div>
</span></font>
</body>
</html>