title: LDAP authentication on Apache against hashed password
body: <p>I have a setup with an apache HTTP server front facing tomcat server. The Apache server uses LDAP for authentication. </p>
  
  <p>I am using an Embedded LDAP server (Apache DS) and have configured to disable anonymous bind using </p>
  
  <pre><code>service.setAllowAnonymousAccess(false); // Disable Anonymous Access
  
  service.setAccessControlEnabled(true); // Enable basic access control check (allow only  System Admin to login to LDAP Server)
  </code></pre>
  
  <p>My application uses Spring LDAP to connect and perform user operations like Adding a user. I have configured it in spring.xml as follows:</p>
  
  <pre class="lang-xml prettyprint-override"><code>  &lt;bean id="ldapContextSource" class="org.springframework.ldap.core.support.LdapContextSource"&gt;
             &lt;property name="url" value="ldap://localhost:389" /&gt;
             &lt;property name="base" value="dc=test,dc=com" /&gt;
             &lt;property name="userDn" value="uid=admin,ou=system" /&gt;
             &lt;property name="password" value="secret" /&gt;
        &lt;/bean&gt;
  </code></pre>
  
  <p>Apache httpd.conf is configured to use basic auth </p>
  
  <pre><code>AuthLDAPBindDN "uid=admin,ou=system"
  AuthLDAPBindPassword "{SHA}&lt;Hash for secret&gt;"
  </code></pre>
  
  <p>ISSUE 1 : When trying to login to ldap server using a client (say jexplorer), I am able to login using both Hashed password and using the plain text "secret". How is that possible?</p>
  
  <p>In this case , if someone gets to know the AuthLDAPBindDN and AuthLDAPBindPassword which is a hashed one in my case, They will be able to login using the same to the LDAP server with full access which is a security threat.</p>
  
  <p>Also, I want to replace the password in spring.xml with a hashed one. Since, admin can change the LDAP password, How do I ensure my application to use the updated hashed password as we are hard-coding it in spring.xml?</p>