I know that support for Argon2
was released with OpenLdap 2.4.5
according to this link https://bugs.openldap.org/show_bug.cgi?id=8575
, but what if I want to use it with a previous version like 2.4.4
is there a way of doing this? Also if argon
is not possible is there a way of using scrypt
for password hashing?
-
Related question What is the best way to store passwords in OpenLDAP? suggests OpenLDAP historically doesn't offer much in terms of advanced password hashing algorithms.– gowenfawrSep 16, 2021 at 18:49
1 Answer
Since the argon2 support is modular, you can try compiling and loading the module into your 2.4.4 installation in the same way - once compiled, load it:
4) Edit your slapd.conf (eg. /etc/ldap/slapd.conf), and add:
moduleload ...path/to/pw-argon2.so
5) Restart slapd.
It is the nature of modular code that it should run under earlier versions that support the same modular framework, and it's a reasonable assumption that 2.4.4 and 2.4.5* are close enough in that respect... as long as you have a safe place to test, "you might as well try it."
The README
file in openldap source code directory contrib/slapd-modules/passwd/argon2
also contains instructions for generating hashes and testing openldap integration.
I would strongly recommend testing this on a standalone test instance before attempting to integrate it into a production instance.
-
Thanks gowenfawr, I will try that out right now!– fishermansoccerSep 16, 2021 at 20:58