README
1PBKDF2 for OpenLDAP
2=======================
3
4pw-pbkdf2.c provides PBKDF2 key derivation functions in OpenLDAP.
5
6Schemes:
7
8 * {PBKDF2} - alias to {PBKDF2-SHA1}
9 * {PBKDF2-SHA1}
10 * {PBKDF2-SHA256}
11 * {PBKDF2-SHA512}
12
13# Requirements
14
15 * OpenSSL 1.0.0 or later
16
17# Installations
18
19First, You need to configure and build OpenLDAP.
20
21 $ cd <OPENLDAP_BUILD_DIR>/contrib/slapd-modules/passwd/
22 $ git clone https://github.com/hamano/openldap-pbkdf2.git
23 $ cd openldap-pbkdf2/
24 $ make
25 # make install
26
27# Configuration
28
29In slapd.conf:
30
31 moduleload pw-pbkdf2.so
32
33You can also tell OpenLDAP to use the schemes when processing LDAP
34Password Modify Extended Operations, thanks to the password-hash
35option in slapd.conf. For example:
36
37 password-hash {PBKDF2}
38or
39 password-hash {PBKDF2-SHA256}
40or
41 password-hash {PBKDF2-SHA512}
42
43# Testing
44
45You can get hash to use slappasswd.
46
47 $ slappasswd -o module-load=pw-pbkdf2.la -h {PBKDF2} -s secret
48 {PBKDF2}60000$Y6ZHtTTbeUgpIbIW0QDmDA$j/aU7jFKUSbH4UobNQDm9OEIwuw
49
50A quick way to test whether it's working is to customize the rootdn and
51rootpw in slapd.conf, eg:
52
53 rootdn "cn=Manager,dc=example,dc=com"
54 rootpw {PBKDF2}60000$Y6ZHtTTbeUgpIbIW0QDmDA$j/aU7jFKUSbH4UobNQDm9OEIwuw
55
56Then to test, run something like:
57
58 $ ldapsearch -x -b "dc=example,dc=com" -D "cn=Manager,dc=example,dc=com" -w secret
59
60# Debugging
61You can specify -DSLAPD_PBKDF2_DEBUG flag for debugging.
62
63# Message Format
64
65 {PBKDF2}<Iteration>$<Adapted Base64 Salt>$<Adapted Base64 DK>
66
67# References
68
69* [RFC 2898 Password-Based Cryptography][^1]
70[^1]: http://tools.ietf.org/html/rfc2898
71
72* [PKCS #5 PBKDF2 Test Vectors][^2]
73[^2]: http://tools.ietf.org/html/draft-josefsson-pbkdf2-test-vectors-06
74
75* [RFC 2307 Using LDAP as a Network Information Service][^3]
76[^3]: http://tools.ietf.org/html/rfc2307
77
78* [Python Passlib][^4]
79[^4]: http://pythonhosted.org/passlib/
80
81* [Adapted Base64 Encoding][^5]
82[^5]: http://pythonhosted.org/passlib/lib/passlib.utils.html#passlib.utils.ab64_encode
83
84# License
85This work is part of OpenLDAP Software <http://www.openldap.org/>.
86
87Copyright 2009-2021 The OpenLDAP Foundation.
88All rights reserved.
89
90Redistribution and use in source and binary forms, with or without
91modification, are permitted only as authorized by the OpenLDAP
92Public License.
93
94A copy of this license is available in the file LICENSE in the
95top-level directory of the distribution or, alternatively, at
96<http://www.OpenLDAP.org/license.html>.
97
98# ACKNOWLEDGEMENT
99This work was initially developed by HAMANO Tsukasa <hamano@osstech.co.jp>
100