nerdexam
Linux_Foundation

LFCS · Question #351

An administrator has manually migrated local accounts to LDAP, instead of using the migration tools. When trying to authenticate as a user, an error is returned about invalid credentials. What is…

The correct answer is A. The password hash type was not included in the user's password attribute. Manually migrating local account passwords to LDAP requires including the password hash type within the user's password attribute for correct authentication.

Submitted by haru.x· Apr 18, 2026User and Group Management

Question

An administrator has manually migrated local accounts to LDAP, instead of using the migration tools. When trying to authenticate as a user, an error is returned about invalid credentials. What is the most likely cause of this?

Options

  • AThe password hash type was not included in the user's password attribute.
  • BShadow passwords are incompatible with OpenLDAP.
  • CThe original password from /etc/passwd was not included.
  • DThe administrator forgot to run slappasswd to convert the hashes in /etc/shadow.
  • EThe administrator forgot to run ldappasswd to convert the hashes in /etc/shadow.

How the community answered

(60 responses)
  • A
    82% (49)
  • B
    5% (3)
  • C
    2% (1)
  • D
    2% (1)
  • E
    10% (6)

Why each option

Manually migrating local account passwords to LDAP requires including the password hash type within the user's password attribute for correct authentication.

AThe password hash type was not included in the user's password attribute.Correct

When local account password hashes are manually copied to an LDAP `userPassword` attribute, the LDAP server needs to know the hashing algorithm used (e.g., SSHA, BCRYPT). Without an explicit prefix indicating the hash type, the server cannot correctly interpret the stored hash to perform authentication verification.

BShadow passwords are incompatible with OpenLDAP.

Shadow passwords are a Linux system concept and are not inherently incompatible with OpenLDAP; OpenLDAP can store various hash types, including those derived from shadow.

CThe original password from /etc/passwd was not included.

The original plaintext password is never stored or migrated directly; only its hash is used for security.

DThe administrator forgot to run slappasswd to convert the hashes in /etc/shadow.

`slappasswd` is used to generate LDAP-compatible password hashes, often with the correct type prefix, but the question states hashes were manually migrated, implying a copy, not a conversion to an LDAP-specific format.

EThe administrator forgot to run ldappasswd to convert the hashes in /etc/shadow.

`ldappasswd` is a client utility to change a user's LDAP password, not to convert existing `/etc/shadow` hashes for migration.

Concept tested: LDAP password hash types and manual migration

Source: https://www.openldap.org/doc/admin24/uggettingstarted.html

Topics

#LDAP#User Management#Authentication#Password Hashing

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full LFCS Practice