pluggable password storage format for ldiftree back end
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- python
- Domain
- authentication, backend
Research direction
Start in ldaptor/entry.py, where password hashes for simple BINDs are currently stored in salted SHA1 format. Review how the LDAP modify password extended request selects the storage format and how the userPassword attribute is handled. Done means the issue's proposed configurable default format, alternate prefixes, and optional password attribute are defined and covered by appropriate tests.
Written by the indexing model from the issue text.
Description
The base classes for LDAP DIT entries found in :file:ldaptor/entry.py are hard-coded to store password hashes for simple BINDs in salted SHA1 format. The entry is prefixed with "{SSHA}". This is similar to one of the schemes that OpenLDAP uses, but allowing alternate schemes may be a good idea.
If the entry has no prefix, it can indicate the password itself is stored in plain text. This is useful to developing and debugging. Different hash formats could have different prefixes. For example {SHA} for unsalted SHA or maybe {PBKDF2} for Password-Based Key Derivation Function 2.
There would need to be a default storage format that is configurable. That would indicate the format used when the LDAP modify password extended request is used.
Also, it may be nice to allow configuration of the attribute in which the password/hash is stored. OpenLDAP allows this, but defaults to userPassword.
- Dominant language
- Python
- Stars
- 167
- Forks
- 53
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from twisted/ldaptor
-
Difficulty 2/5 1-3 hours Newbie friendliness 58/100
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
earthtojake/text-to-cad#758 ·
Maintainers usually reply within 1 day
-
domain:upgrades enhancement needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
gke-labs/kube-agents#4634 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
agardnerIT/opamp-server-py#116 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
enhancement good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
elviskahoro/sdk-python-attio#144 · 1 comment ·
Maintainers usually reply within 1 day