title: How to make ldap evaluate clear text password vs DES stored password
body: <p>I use openldap slapd 2.4.40 and postgresql9.2.23 as back-sql on CentoS 6.9</p>
  
  <p>user and password for LDAP <code>uid</code> and <code>userPassword</code> are stored in postgresql by DES encoding.</p>
  
  <p>Original clear text is <code>JacicFk5</code> </p>
  
  <p>DES encoded/encrypted text is <code>IfjFxsltK/MPE</code> which stored in DB.</p>
  
  <p>I can see the user information as the result of ldapseach by stored password.</p>
  
  <pre><code>ldapsearch -x  -b "dc=example,dc=com" -D uid="HDZZZ0R0N,ou=people,dc=example,dc=com" -w IfjFxsltK/MPE '(&amp;(uid= HDZZZ0R0N)(objectClass=*))'          
  # extended LDIF
  #
  # LDAPv3
  # base &lt;dc=example,dc=com&gt; with scope subtree
  # filter: (&amp;(uid= HDZZZ0R0N)(objectClass=*))
  # requesting: ALL
  #
  
  # user01, people, example.com
  dn: uid= HDZZZ0R0N,ou=people,dc=example,dc=com
  objectClass: inetOrgPerson
  cn:: W+aOkl3lia/nlKPnianjg6Hjg7Pjg4bjg4rjg7PjgrnvvIgzNu+8iVNURw==
  sn:: W+aOkl3lia/nlKPnianjg6Hjg7Pjg4bjg4rjg7PjgrnvvIgzNu+8iVNURw==
  uid: HDZZZ0R0N
  userPassword:: SWZqRnhzbHRLL01QRQ==
  </code></pre>
  
  <p>However, I can’t do ldapsearch by original clear text password</p>
  
  <pre><code>ldapsearch -x -b "dc=example,dc=com" -D uid="HDZZZ0R0N,ou=people,dc=example,dc=com" -w JacicFk5 '(&amp;(uid= HDZZZ0R0N)(objectClass=*))'
  ldap_bind: Invalid credentials (49)
  </code></pre>
  
  <p>Does anyone tell me how to make ldapsearch to resolve given password by clear text and stored password by DES encoding?</p>
  
  <p>I’d like to know is how to make plaintext <code>JacicFk5</code> from ldapseach command-line to hash <code>IfjFxsltK/MPE</code> and make it match against <code>IfjFxsltK/MPE</code> in DB as <code>userPassowrd</code>.</p>
  
  <p>Is there suitable directive for <code>ldap.conf</code> or <code>slapd.conf</code>?</p>
  
  <p>I've checked followings .</p>
  
  <pre><code>echo "SWZqRnhzbHRLL01QRQ==" |perl -MMIME::Base64 -ne 'print decode_base64($_) . "\n"'
  </code></pre>
  
  <p>it returns <code>IfjFxsltK/MPE</code></p>
  
  <pre><code>perl -e 'print("userPassword: {crypt}".crypt("JacicFk5","If")."\n");'
  </code></pre>
  
  <p>it returns <code>userPassword: {crypt}IfjFxsltK/MPE</code></p>
  
  <p>One more info.
  my ldapseach can solve password text for users stored in AD server via ownclod.</p>