On Jun 3, 2013, at 1:08 PM, Hallvard Breien Furuseth <[email protected]>
wrote:
> ...OTOH perhaps it's too late to change {cleartext} now if
> it has an established useful meaning. Could introduce a new
> scheme called {plaintext} or {raw} instead for this purpose.
{CLEARTEXT} isn't an RFC 2307 hash scheme... it's a string used in
configuration and command line cases to indicate that no RFC 2307 hash scheme
is used, that is, the password is cleartext. In the code, IIRC, it's referred
to as pseudo-scheme for this reason.
The restrictions on clear text passwords that look like RFC 2307 hashed
password exist because of the conflict between standard LDAPv3 behavior and RFC
2307 behavior.
Adding some RFC 2307 plain-text hash scheme doesn't remove the conflict between
standard LDAPv3 behavior RFC 2307 hashed passwords, so IMO the restriction
should remain, at least by default. If such an option were introduced, the
documentation should make clear that disabling the check can be problematic if
ever stored hash passwords are to restored (on Bind) to LDAPv3 compliant LDAPv3
passwords over a period of time.
-- Kurt
