nerdexam
CompTIA

LX0-104 · Question #351

An administrator has manually migrated local accounts to LDAP, instead of using the migration tools. When trying to authenticate as a user, an error is returned about invalid credentials. What is…

The correct answer is A. The password hash type was not included in the user's password attribute. When manually migrating passwords to LDAP, the password hash type (e.g., SSHA, BCRYPT) must be specified within the user's password attribute to allow the LDAP server to correctly authenticate users.

Essential System Services

Question

An administrator has manually migrated local accounts to LDAP, instead of using the migration tools. When trying to authenticate as a user, an error is returned about invalid credentials. What is the most likely cause of this?

Options

  • AThe password hash type was not included in the user's password attribute.
  • BShadow passwords are incompatible with OpenLDAP.
  • CThe original password from /etc/passwd was not included.
  • DThe administrator forgot to run slappasswd to convert the hashes in /etc/shadow.
  • EThe administrator forgot to run ldappasswd to convert the hashes in /etc/shadow.

How the community answered

(26 responses)
  • A
    77% (20)
  • C
    4% (1)
  • D
    12% (3)
  • E
    8% (2)

Why each option

When manually migrating passwords to LDAP, the password hash type (e.g., SSHA, BCRYPT) must be specified within the user's password attribute to allow the LDAP server to correctly authenticate users.

AThe password hash type was not included in the user's password attribute.Correct

Without specifying the password hash type (e.g., '{SSHA}...') in the user's `userPassword` attribute, the LDAP server does not know how to interpret and compare the provided password against the stored hash, leading to authentication failure.

BShadow passwords are incompatible with OpenLDAP.

Shadow passwords are a Linux system feature for local accounts; OpenLDAP stores password hashes, not shadow passwords directly, and they are not inherently incompatible.

CThe original password from /etc/passwd was not included.

The original cleartext password from `/etc/passwd` should never be included in an LDAP entry; only its hash is stored.

DThe administrator forgot to run slappasswd to convert the hashes in /etc/shadow.

`slappasswd` is used to generate password hashes for use in LDAP entries, not to automatically convert `/etc/shadow` hashes with missing type information.

EThe administrator forgot to run ldappasswd to convert the hashes in /etc/shadow.

`ldappasswd` is used to change an existing user's password in LDAP, not to convert `/etc/shadow` hashes during a migration.

Concept tested: LDAP password hash types for authentication

Source: https://www.openldap.org/doc/admin24/slapdconf2.html#Password%20options

Topics

#LDAP authentication#Password hashing#Troubleshooting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full LX0-104 Practice