Active Directory userPassword attribute

Question

I've read a little around the subject of the userPassword attribute in AD and how it can be set as a write-alias for unicodePwd.

We're considering moving from OpenLDAP to AD. I can extract the userPassword from OpenLDAP as a salted hashed string {ssha}blabla... My question is, can I then set this password "as is" in the userPassword attribute of AD with write-alias activated, and have that then update the unicodePwd attribute automatically? Or does the userPassword field expect passwords in clear?

Basically is there any way I can transfer the user passwords from OpenLDAP to AD?

Solution

I don't believe it can be done, due to the fact that the hash is not reversible and is salted.

Usually, even between AD domains, tools that do this intercept the password change request at the domain controller level and execute the change on both domains at the same time, it is not done through a synchronization of the actual LDAP attribute data.

I'd suggest investigating alternatives such as a web interface where people could authenticate against the old LDAP that would grab the password and set it in AD, or something similar.

Comments

[ianbeks]

Thanks. Shame there's no way to do this. Can't see why they don't allow it because it's not exactly a security issue.