Le 24/07/15 15:50, Kiran Ayyagari a écrit : > On Fri, Jul 24, 2015 at 3:31 AM, Theisen, Lucas <[email protected]> wrote: > >> I have need to hash more than just the userPassword attribute (I store >> the answers to security questions as well), and figured other people may >> need the same feature. I would add it to the source branch, but my >> solution was to hard code the list of hashed OID’s in classes similar those >> in the interceptors-hash module. In order to make it generic enough to add >> to the project, I would need a better way to feed in the list of OID’s >> (rather than compile). I know that binary attributes are set on the client >> via org.apache.directory.api.ldap.codec.api.BinaryAttributeDetector, but >> since this would be server side, that approach would not work. All server >> config seems to be ldif oriented, but this would require a custom attribute >> for this new option, perhaps something like: >> >> ads-interceptorconfig: any-config-string-here >> >> >> >> Or an even more generic: >> >> ads-customconfig: any-config-string-here >> >> That would be allowed in any config (not just interceptors). I could do >> it without the additional attribute using system properties, but that seems >> wonky… The idea is to add some configuration in the HashInterceptor configuration. You can create a new ObjectClass for that and add some new AttributeType to store the OID to be hashed.
One exemple is the ads-authenticator OC which has the ads-authenticatorId AT : dn: m-oid=1.3.6.1.4.1.18060.0.4.1.3.901, ou=objectClasses, cn=adsconfig, ou=schema m-oid: 1.3.6.1.4.1.18060.0.4.1.3.901 m-name: ads-authenticator m-description: A generic authenticator objectclass: top objectclass: metaTop objectclass: metaObjectClass m-supobjectclass: ads-base m-typeobjectclass: ABSTRACT m-must: ads-authenticatorId m-must: ads-baseDn dn: m-oid=1.3.6.1.4.1.18060.0.4.1.2.930,ou=attributeTypes,cn=adsconfig,ou=schema m-ordering: caseExactOrderingMatch m-singlevalue: TRUE m-oid: 1.3.6.1.4.1.18060.0.4.1.2.930 m-description: Authenticator Id m-substr: caseExactSubstringsMatch objectclass: metaTop objectclass: metaAttributeType objectclass: top m-syntax: 1.3.6.1.4.1.1466.115.121.1.44 m-name: ads-authenticatorId m-equality: caseExactMatch m-length: 0 >> >> Anyway, my questions are: >> >> Is anybody else interested in this feature? >> > sounds like a reasonable addition +1 > > Any other suggestions? > > what I would do is to add support for configuring one or more attributes in > this interceptor > something like, 'ads-hashAttibute' a multi valued attributes +1 > >> And if I do this, should we change the base class from >> PasswordHashingInterceptor to HashingInterceptor? >> > how about creating HashingInterceptor by extracting common functionality > out of > PasswordHashingIntereceptor and make later a subclass of former? +1
