如何为Active Directory用户设置md5哈希密码

Question

Have a lot of users with passwords stored as md5 hash. Now want to add all those users to Active Directory. Everything works perfectly with unicode passwords for new users. But we don't have plain passwords for old ones.

Found that I can send md5 hashed password to AD adding:

$user['userPassword'] = '{MD5}'.base64_encode(pack('H*', md5($password)));

But it looks like AD does not understand that format. But accepts user creation request. If look through the user properties - no such attribute as userPassword and rejects at login.

How should be configured AD in order to receive such passwords and understand them?

Answer 1

Sorry, AD doesn't natively support injecting hashes like this over LDAP... (Plus, you are assuming AD stores them exactly the same as your previous system, which may or may not be the case)

I could suggest approaches but they will all come back to getting non-hashed passwords in your hands and writing them via the mechanisms you already know of.