Giters

casdoor / casdoor

An open-source UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform with web UI supporting OAuth 2.0, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, RADIUS, Google Workspace, Active Directory and Kerberos

Home Page:https://casdoor.org

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Support password hashing in LDAP

GhostLee opened this issue · comments

commented

sometime we don't save plaintext password in LDAP Server, so support password hashing is very useful, input a plaintext password, convert it into hashed password and compare with LDAP password field output the check result.

commented

and the attribute should be configurated

commented

@GhostLee We will add support for multiple password types as soon as possible. For configurable attributes, we plan to do this during the implementation of LDAP in the syncers.

commented

@GhostLee I found that there is no relationship between the password type of Casdoor and the LDAP server. I sent the password entered by the user to the LDAP server using a bind request and the authentication all passed regardless of the LDAP password type. On the contrary, if I encrypt the password in Casdoor, it will not pass.

My environment is Apache Directory Studio 2.0.0.

commented

@GhostLee Casdoor always sends plain password to your LDAP server via LDAP protocol. So it's your LDAP server to decide whether to hash the password. It's not a Casdoor issue.