request to have sha2 module in contrib included in package

[ben thielsen]

there is an sha2 module in the openldap source contrib directory which implements the following sha2 password hashing schemes:

{SSHA-512}
{SSHA-384}
{SSHA-256}
{SHA-512}
{SHA-384}
{SHA-256}

i'd like to have it included in the slapd package.

the module can be found in contrib/slapd-modules/passwd/sha2/

following the standard "make depend" when building openldap, the module can be built by running "make" in its directory. note that i had to add -fPIC to CCFLAGS in order to get it to build - e.g:

CCFLAGS = -Wall -g -fPIC

this may or may not be the right way to do this.

regards
-ben

[Clint Byrum (clint-fewbar)]

Hi Ben. This seems like a reasonable request. You should note that upstream would prefer that people not use these password methods and instead focus on SCRAM based methods. See the discussion on why this module isn't in core here:

http://www.openldap.org/its/index.cgi/Contrib?id=7278;page=4

[Clint Byrum (clint-fewbar)]

One concern though is that this embeds "yet another" copy of a SHA2 algorithm.. and its even likely that this one has been embedded elsewhere so that may present maintenance problems if a problem is ever found with this particular code.

[ben thielsen (btb-bitrate)]

On Aug 05, 2012, at 10.17, Clint Byrum wrote:

> Hi Ben. This seems like a reasonable request. You should note that
> upstream would prefer that people not use these password methods and
> instead focus on SCRAM based methods. See the discussion on why this
> module isn't in core here:
>
> http://www.openldap.org/its/index.cgi/Contrib?id=7278;page=4

hi-

thanks for the reference, i hadn't heard of scram before.

-ben

[ben thielsen (btb-bitrate)]

i gather this means that this module is independently implementing the algorithm rather than using existing [openssl/gnutls/etc] libraries? is there a compromise that might be reached?

[Ryan Tandy (rtandy)]

The slapd package in wily now provides the pw-sha2 module.