From: Francis Cianfrocca <garbagecat10@...>
Date: 2007-08-22T20:41:29+09:00
Subject: Re: MD5 authentication against Active Directory with ruby ldap

------=_Part_21451_24365362.1187782892526
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

On 8/22/07, James Yang <macinux@gmail.com> wrote:
>
> Here is the code:
>
> ------------------------------------------
>
> require 'ldap'
> require 'base64'
> require 'digest/md5'
>
>   pass = "{MD5}" + Base64.encode64(Digest::MD5.digest("secret") ).chomp
> #  pass='secret'
>   conn = LDAP::Conn.new( 'dc.domain.com', 389 )
>   conn.set_option( LDAP::LDAP_OPT_PROTOCOL_VERSION, 3 )
>   conn.bind('admin@domain.com',pass)
>
> ---------------------------------------------
>
> The problem is it doesn't work with MD5 hashed password but it works
> with the plain text password ('secret'). I really appreciate it if
> somebody can help me out.
>
> James
> --
> Posted via http://www.ruby-forum.com/.
>
>

This makes sense. LDAP directories store password hashes instead of
passwords to make it impossible for anyone who has access to the directory's
datastore (like a programmer, a sysadmin, a backup admin, or a hacker) to
get enough information to be able to bind.

If you could actually bind using a password hash, then the hashes stored in
the directory itself would in effect be plaintext, which defeats the whole
purpose.

------=_Part_21451_24365362.1187782892526--