luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

docs: add ldap ppolicy to enforce password hashing (#9856) 

* docs: add ldap ppolicy to enforce password hashing

* formatting

* grammar

* Clarify password policy doc
This commit is contained in:
Jason O'Donnell 2020-08-31 13:05:27 -04:00 committed by GitHub
parent 24794d8457
commit b2110a2e87
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
website/pages/docs/secrets/openldap/index.mdx
View File

@ -61,6 +61,35 @@ This plugin currently supports LDAP v3.
$ vault read openldap/static-role/hashicorp
```
## LDAP Password Policy
The OpenLDAP secret engine does not hash or encrypt passwords prior to modifying
values in LDAP. This behavior can cause plaintext passwords to be stored in LDAP.
To avoid having plaintext passwords stored, the LDAP server should be configured
with an LDAP password policy (ppolicy, not to be confused with a Vault password
policy). A ppolicy can enforce rules such as hashing plaintext passwords by default.
The following is an example of an LDAP password policy to enforce hashing on the
data information tree (DIT) `dc=hashicorp,dc=com`:
```
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: ppolicy
dn: olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcPPolicyConfig
objectClass: olcOverlayConfig
olcOverlay: {2}ppolicy
olcPPolicyDefault: cn=default,ou=pwpolicies,dc=hashicorp,dc=com
olcPPolicyForwardUpdates: FALSE
olcPPolicyHashCleartext: TRUE
olcPPolicyUseLockout: TRUE
```
## Schema
The OpenLDAP Secret Engine supports three different schemas: `openldap` (default),