CryptPasswordStorageSchemeConfiguration.xml revision bccd35904bb6c244e7eae5b7ddb28e5c295e856b
<?xml version="1.0" encoding="UTF-8"?>
<!--
! CDDL HEADER START
!
! The contents of this file are subject to the terms of the
! Common Development and Distribution License, Version 1.0 only
! (the "License"). You may not use this file except in compliance
! with the License.
!
! You can obtain a copy of the license at legal-notices/CDDLv1_0.txt
! See the License for the specific language governing permissions
! and limitations under the License.
!
! When distributing Covered Code, include this CDDL HEADER in each
! file and include the License file at legal-notices/CDDLv1_0.txt.
! If applicable, add the following below this CDDL HEADER, with the
! fields enclosed by brackets "[]" replaced with your own identifying
! information:
! Portions Copyright [yyyy] [name of copyright owner]
!
! CDDL HEADER END
!
!
! Copyright 2007-2008 Sun Microsystems, Inc.
! Portions Copyright 2010-2013 ForgeRock AS
! Portions Copyright 2012 Dariusz Janny <dariusz.janny@gmail.com>
! -->
<adm:managed-object name="crypt-password-storage-scheme"
plural-name="crypt-password-storage-schemes"
package="org.forgerock.opendj.admin"
extends="password-storage-scheme"
xmlns:adm="http://www.opends.org/admin"
xmlns:ldap="http://www.opends.org/admin-ldap">
<adm:synopsis>
The
<adm:user-friendly-name />
provides a mechanism for encoding user passwords like Unix crypt does.
Like on most Unix systems, the password may be encrypted using different
algorithms, either Unix crypt, md5, sha256 or sha512.
</adm:synopsis>
<adm:description>
This implementation contains an implementation for the user
password syntax, with a storage scheme name of "CRYPT". Like on most
Unixes, the "CRYPT" storage scheme has different algorithms, the default
being the Unix crypt.
Even though the Unix crypt is a one-way digest, it
is relatively weak by today's standards. Because it supports
only a 12-bit salt (meaning that there are only 4096 possible ways to
encode a given password), it is also vulnerable to dictionary attacks.
You should therefore use this storage scheme only in cases where an
external application expects to retrieve the password and verify it
outside of the directory, rather than by performing an LDAP bind.
</adm:description>
<adm:profile name="ldap">
<ldap:object-class>
<ldap:name>ds-cfg-crypt-password-storage-scheme</ldap:name>
<ldap:superior>ds-cfg-password-storage-scheme</ldap:superior>
</ldap:object-class>
</adm:profile>
<adm:property-override name="java-class" advanced="true">
<adm:default-behavior>
<adm:defined>
<adm:value>
</adm:value>
</adm:defined>
</adm:default-behavior>
</adm:property-override>
<adm:property name="crypt-password-storage-encryption-algorithm" mandatory="true">
<adm:synopsis>
Specifies the algorithm to use to encrypt new passwords.
</adm:synopsis>
<adm:description>
Select the crypt algorithm to use to encrypt new passwords.
The value can either be "unix", which means the password is encrypted
with the Unix crypt algorithm, or md5 which means the password is
encrypted with the BSD MD5 algorithm and has a $1$ prefix,
or sha256 which means the password is encrypted with the SHA256 algorithm
and has a $5$ prefix, or sha512 which means the password is encrypted with
the SHA512 algorithm and has a $6$ prefix.
</adm:description>
<adm:default-behavior>
<adm:defined>
<adm:value>unix</adm:value>
</adm:defined>
</adm:default-behavior>
<adm:syntax>
<adm:enumeration>
<adm:value name="unix">
<adm:synopsis>
New passwords are encrypted with the Unix crypt algorithm.
</adm:synopsis>
</adm:value>
<adm:value name="md5">
<adm:synopsis>
New passwords are encrypted with the BSD MD5 algorithm.
</adm:synopsis>
</adm:value>
<adm:value name="sha256">
<adm:synopsis>
New passwords are encrypted with the Unix crypt SHA256 algorithm.
</adm:synopsis>
</adm:value>
<adm:value name="sha512">
<adm:synopsis>
New passwords are encrypted with the Unix crypt SHA512 algorithm.
</adm:synopsis>
</adm:value>
</adm:enumeration>
</adm:syntax>
<adm:profile name="ldap">
<ldap:attribute>
<ldap:name>ds-cfg-crypt-password-storage-encryption-algorithm</ldap:name>
</ldap:attribute>
</adm:profile>
</adm:property>
</adm:managed-object>