Help with LDAP Active Directory Authentication

Discussions of secure PHP coding. Security in software is important, so don't be afraid to ask. And when answering: be anal. Nitpick. No security vulnerability is too small.

Moderator: General Moderators

Post Reply
ferio-moreno
Forum Commoner
Posts: 30
Joined: Tue Feb 28, 2006 10:31 pm
Location: florida

Help with LDAP Active Directory Authentication

Post by ferio-moreno »

Hello, I'm at work and my new assignment is to make a login screen for the employees here, The username's match up fine, but the passwords are all encrypted (which they should be) but I don't know what they were encrypted with.

so my question is, what kind of function(?) would I have to use to make a password that was say " 12345 " equal to " ˆ‡þ[É¥ÏI„F|/
User avatar
neophyte
DevNet Resident
Posts: 1537
Joined: Tue Jan 20, 2004 4:58 pm
Location: Minnesota

Post by neophyte »

You'll want to check out the ldap extension. There some great examples over at:

http://us2.php.net/manual/en/ref.ldap.php
ferio-moreno
Forum Commoner
Posts: 30
Joined: Tue Feb 28, 2006 10:31 pm
Location: florida

Post by ferio-moreno »

thx for replying bro :) But i've already read through that, I was wondering in which way would I encrypt it i.e.(sha1,crypt,mcrypt,etc.) in order to get the html symbols I posted above if my password were '12345'.
Roja
Tutorials Group
Posts: 2692
Joined: Sun Jan 04, 2004 10:30 pm

Post by Roja »

ferio-moreno wrote:thx for replying bro :) But i've already read through that, I was wondering in which way would I encrypt it i.e.(sha1,crypt,mcrypt,etc.) in order to get the html symbols I posted above if my password were '12345'.
Its too small of a sample to determine that from. Worse, it will vary - you can't reproduce it, because Windows AD passwords are salt'ed. Further, AD admins have the choice of a number of encryption protocols, and as if THAT wasn't bad enough, the way you received that password also can influence the encryption level used.

In a nutshell, if you don't know, you can't know, and even if you do know, you can't duplicate it (easily or securely).
Post Reply