Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins by droideck · Pull Request #6447 · 389ds/389-ds-base

droideck · 2024-12-12T01:45:36Z

Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in
PBKDF2-* password storage plugin entries. This was password hashing round value can be adjusted.
Certain compliance requirements (like from BSI) require specific hashing round values greater than
what we currently provide.

Fixes: #6269

Reviewed by: ?

Firstyear

Looks really good, nice to see you looking at the rust side :)

Firstyear · 2024-12-12T01:50:04Z

+const MAX_PBKDF2_ROUNDS: usize = 1_000_000;
+
+const PBKDF2_ROUNDS_ATTR: &str = "nsslapd-pwdPBKDF2Rounds";
+static PBKDF2_ROUNDS: Lazy<RwLock<usize>> = Lazy::new(|| RwLock::new(DEFAULT_PBKDF2_ROUNDS));


Consider using https://doc.rust-lang.org/std/sync/atomic/struct.AtomicUsize.html with Ordering::Relaxed

I just realized we need to make the PBKDF2_ROUNDS a HashMap, as we might use different values in different schemes.

Do you know what the best option for our case is?

I found dashmap option Lazy<DashMap<MessageDigest, usize>> or we can make a RwLock HashMap like this RwLock<HashMap<MessageDigest, usize>>...
And I think there can be more...

Okay, I tried a few approaches (even Rust's generics...), and I think the one in the last commit will work the best.
It's the simple AtomicUsize variables - one for each digest.

tbordaz

C/template part of the patch LGTM. A minor question

tbordaz

oppss forgot to add my questions ;)

…2-* plugins Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This was password hashing round value can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Fixes: 389ds#6269 Reviewed by: ?

droideck · 2024-12-20T00:45:20Z

Okay, it's ready for the final review!
I additionally covered UI, CLI, and tests.

Design doc: 389ds/389ds.github.io#17

Please check! Thank you!

droideck · 2024-12-20T19:06:17Z

Changes are made, please, review

progier389

LGTM

…has functions

tbordaz

LGTM

Firstyear

Yep, the changes to the rust code look good to me :)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

droideck marked this pull request as draft December 12, 2024 01:50

droideck added the work in progress Work in Progress - can be reviewed, but not ready for merge. label Dec 12, 2024

Firstyear reviewed Dec 12, 2024

View reviewed changes

tbordaz reviewed Dec 12, 2024

View reviewed changes

Comment thread ldap/schema/01core389.ldif Outdated

Comment thread ldap/schema/01core389.ldif Outdated

droideck force-pushed the rust-pbkdf2-add-param branch 3 times, most recently from d1025bd to 2f0db06 Compare December 19, 2024 23:51

droideck force-pushed the rust-pbkdf2-add-param branch from 2f0db06 to 3603e54 Compare December 20, 2024 00:43

droideck removed the work in progress Work in Progress - can be reviewed, but not ready for merge. label Dec 20, 2024

droideck marked this pull request as ready for review December 20, 2024 00:46

progier389 reviewed Dec 20, 2024

View reviewed changes

Comment thread dirsrvtests/tests/suites/password/pbkdf2_upgrade_plugin_test.py Outdated

Comment thread dirsrvtests/tests/suites/pwp_storage/storage_test.py

Comment thread ldap/ldif/template-dse-minimal.ldif.in

droideck requested review from Firstyear, progier389 and tbordaz December 20, 2024 19:06

Fix Pierre's comments

802fb91

droideck force-pushed the rust-pbkdf2-add-param branch from 6496b99 to 802fb91 Compare December 23, 2024 16:16

progier389 approved these changes Jan 2, 2025

View reviewed changes

tomato42 reviewed Jan 2, 2025

View reviewed changes

Comment thread src/lib389/lib389/password_plugins.py Outdated

tomato42 reviewed Jan 2, 2025

View reviewed changes

Comment thread src/lib389/lib389/password_plugins.py Outdated

Increase DEFAULT_PBKDF2_ROUNDS to 100_000 and make it common for all …

9156f11

…has functions

droideck force-pushed the rust-pbkdf2-add-param branch from d4ec94a to 9156f11 Compare January 3, 2025 04:22

tbordaz approved these changes Jan 3, 2025

View reviewed changes

Firstyear approved these changes Jan 7, 2025

View reviewed changes

droideck merged commit b8e442b into 389ds:main Jan 8, 2025

droideck deleted the rust-pbkdf2-add-param branch January 15, 2026 05:29

Conversation

droideck commented Dec 12, 2024

Uh oh!

Firstyear left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Firstyear Dec 12, 2024

Choose a reason for hiding this comment

Uh oh!

droideck Dec 12, 2024

Choose a reason for hiding this comment

Uh oh!

droideck Dec 17, 2024

Choose a reason for hiding this comment

Uh oh!

tbordaz left a comment

Choose a reason for hiding this comment

Uh oh!

tbordaz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

droideck commented Dec 20, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

droideck commented Dec 20, 2024

Uh oh!

progier389 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

tbordaz left a comment

Choose a reason for hiding this comment

Uh oh!

Firstyear left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants