From: James Yang <macinux@...>
Date: 2007-08-23T06:12:08+09:00
Subject: Re: MD5 authentication against Active Directory with ruby ld

Thanks Francis, but I am still confused. what you mean we have to use 
password in plain text to bind with Active Directory? Because the 
password would be saved in a configuration file, which is vulnerable. 
I'd like to save the hashed password in the configuration to bind with 
AD. I just changed the group policy on AD to allow "store passwords 
using reversible encryption" But it still takes the plain text binding 
and gives the error to the MD5 hashed password.





Francis Cianfrocca wrote:
> On 8/22/07, James Yang <macinux@gmail.com> wrote:
>> #  pass='secret'
>> James
>> --
>> Posted via http://www.ruby-forum.com/.
>>
>>
> 
> This makes sense. LDAP directories store password hashes instead of
> passwords to make it impossible for anyone who has access to the 
> directory's
> datastore (like a programmer, a sysadmin, a backup admin, or a hacker) 
> to
> get enough information to be able to bind.
> 
> If you could actually bind using a password hash, then the hashes stored 
> in
> the directory itself would in effect be plaintext, which defeats the 
> whole
> purpose.

-- 
Posted via http://www.ruby-forum.com/.