Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Implement PBKDF2-HMAC-SHA256 and PBKDF-HMAC-SHA512 password encoding schemes #228

Merged
merged 1 commit into from
May 11, 2022

Conversation

lscorcia
Copy link
Contributor

This PR introduces the PBKDF2-HMAC-SHA256 and the PBKDF-HMAC-SHA512 password encoding schemes. They are essentially identical to the existing PBKDF2 encoding scheme, except that the latter uses the SHA1 hashing function, while the former use SHA256/SHA512.

Thanks to this similarity, it is possible to generalize most of the code into an abstract class and the only change required is to choose the hashing algorithm + some minor refactoring.

Preencoded values for testing:

testing
-> {PBKDF2-HMAC-SHA256}15000:lShdzU33covbDNiqGVDffdHh/86VaECJlaaNXchT0exQanVuMVRNR0VRbk0=

During testing it can be useful to tweak the default password policy to allow preencoded passwords with the following command:

./bin/dsconfig -p 4444 -h localhost -D "cn=Directory Manager" -w <password> set-password-policy-prop --policy-name "Default Password Policy" --set allow-pre-encoded-passwords:true -Xn

This PR also adds the corresponding server attributes documentation.

@vharseko vharseko merged commit dde03e7 into OpenIdentityPlatform:master May 11, 2022
@vharseko
Copy link
Member

thanks 👍

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants