Authenticate encrypted/hashed password about passport-ldapauth HOT 3 CLOSED

Hi,

No, you cannot do that. The point of hashed passwords usually is that they cannot be (easily) decrypted. In LDAP authentication the LDAP server validates the user given password in bind, there should be no need for you to handle the password, at least authentication wise. Use Google if you wish to find a tool for cracking SSHA hashes.

from passport-ldapauth.

Thanks vesse!

I have been searching it for a long while. I did not find any way yet. I have enabled SSL communication in LDAP server. And i'm using ldapjs client, but unfortunately that client stores the password in cleartext because if we encrypt/hash the password it can not be decrypted in bind operation. So should we leave it clear text or any other suggested solution?

from passport-ldapauth.

I'm not too familiar with LDAP servers, but I believe it should be the server that performs the hashing, and quick googling showed that at least openLDAP can be configured to hash the passwords. This way it would not be your problem, and the server could perform bind as it would be able to hash the bind password and compare it to the hash in it's database.

Now if you have manually hashed the password and stored it to LDAP server that is configured to use plain text authentication it expects the hash to be passed as password in bind. If you use algorithm that will produce same output for same input on every call you could add a middleware that will change the user provided password to the hash before it is passed on to passport-ldapauth.

from passport-ldapauth.