Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins #6447

droideck · 2024-12-12T01:45:36Z

Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in
PBKDF2-* password storage plugin entries. This was password hashing round value can be adjusted.
Certain compliance requirements (like from BSI) require specific hashing round values greater than
what we currently provide.

Fixes: #6269

Reviewed by: ?

Firstyear

Looks really good, nice to see you looking at the rust side :)

src/slapi_r_plugin/src/error.rs

Firstyear · 2024-12-12T01:50:04Z

src/plugins/pwdchan/src/lib.rs

+const MAX_PBKDF2_ROUNDS: usize = 1_000_000;
+
+const PBKDF2_ROUNDS_ATTR: &str = "nsslapd-pwdPBKDF2Rounds";
+static PBKDF2_ROUNDS: Lazy<RwLock<usize>> = Lazy::new(|| RwLock::new(DEFAULT_PBKDF2_ROUNDS));


Consider using https://doc.rust-lang.org/std/sync/atomic/struct.AtomicUsize.html with Ordering::Relaxed

I just realized we need to make the PBKDF2_ROUNDS a HashMap, as we might use different values in different schemes.

Do you know what the best option for our case is?

I found dashmap option Lazy<DashMap<MessageDigest, usize>> or we can make a RwLock HashMap like this RwLock<HashMap<MessageDigest, usize>>...
And I think there can be more...

Okay, I tried a few approaches (even Rust's generics...), and I think the one in the last commit will work the best.
It's the simple AtomicUsize variables - one for each digest.

tbordaz

C/template part of the patch LGTM. A minor question

tbordaz

oppss forgot to add my questions ;)

ldap/schema/01core389.ldif

…2-* plugins Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This was password hashing round value can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Fixes: 389ds#6269 Reviewed by: ?

droideck · 2024-12-20T00:45:20Z

Okay, it's ready for the final review!
I additionally covered UI, CLI, and tests.

Design doc: 389ds/389ds.github.io#17

Please check! Thank you!

dirsrvtests/tests/suites/password/pbkdf2_upgrade_plugin_test.py

dirsrvtests/tests/suites/pwp_storage/storage_test.py

ldap/ldif/template-dse-minimal.ldif.in

droideck · 2024-12-20T19:06:17Z

Changes are made, please, review

progier389

LGTM

src/lib389/lib389/password_plugins.py

…has functions

tbordaz

LGTM

Firstyear

Yep, the changes to the rust code look good to me :)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

@Firstyear

…2-* plugins (#6447) Description: Add nsslapd-pwdPBKDF2Rounds attribute that can be configured in PBKDF2-* password storage plugin entries. This is a password hashing round value that can be adjusted. Certain compliance requirements (like from BSI) require specific hashing round values greater than what we currently provide. Add CLI, Web UI option, and CI tests. Increase DEFAULT_PBKDF2_ROUNDS to 100_000. Fixes: #6269 Reviewed by: @Firstyear, @progier389, @tbordaz (Thanks!!!)

droideck marked this pull request as draft December 12, 2024 01:50

droideck added the work in progress Work in Progress - can be reviewed, but not ready for merge. label Dec 12, 2024

Firstyear reviewed Dec 12, 2024

View reviewed changes

tbordaz reviewed Dec 12, 2024

View reviewed changes

ldap/schema/01core389.ldif Outdated Show resolved Hide resolved

ldap/schema/01core389.ldif Outdated Show resolved Hide resolved

droideck force-pushed the rust-pbkdf2-add-param branch 3 times, most recently from d1025bd to 2f0db06 Compare December 19, 2024 23:51

droideck force-pushed the rust-pbkdf2-add-param branch from 2f0db06 to 3603e54 Compare December 20, 2024 00:43

droideck removed the work in progress Work in Progress - can be reviewed, but not ready for merge. label Dec 20, 2024

droideck marked this pull request as ready for review December 20, 2024 00:46

progier389 reviewed Dec 20, 2024

View reviewed changes

dirsrvtests/tests/suites/password/pbkdf2_upgrade_plugin_test.py Outdated Show resolved Hide resolved

dirsrvtests/tests/suites/pwp_storage/storage_test.py Show resolved Hide resolved

ldap/ldif/template-dse-minimal.ldif.in Show resolved Hide resolved

droideck requested review from Firstyear, progier389 and tbordaz December 20, 2024 19:06

Fix Pierre's comments

802fb91

droideck force-pushed the rust-pbkdf2-add-param branch from 6496b99 to 802fb91 Compare December 23, 2024 16:16

progier389 approved these changes Jan 2, 2025

View reviewed changes

tomato42 reviewed Jan 2, 2025

View reviewed changes

src/lib389/lib389/password_plugins.py Outdated Show resolved Hide resolved

tomato42 reviewed Jan 2, 2025

View reviewed changes

src/lib389/lib389/password_plugins.py Outdated Show resolved Hide resolved

Increase DEFAULT_PBKDF2_ROUNDS to 100_000 and make it common for all …

9156f11

…has functions

droideck force-pushed the rust-pbkdf2-add-param branch from d4ec94a to 9156f11 Compare January 3, 2025 04:22

tbordaz approved these changes Jan 3, 2025

View reviewed changes

Firstyear approved these changes Jan 7, 2025

View reviewed changes

droideck merged commit b8e442b into 389ds:main Jan 8, 2025
199 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins #6447

Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins #6447

droideck commented Dec 12, 2024

Firstyear left a comment

Firstyear Dec 12, 2024

droideck Dec 12, 2024

droideck Dec 17, 2024

tbordaz left a comment

tbordaz left a comment

droideck commented Dec 20, 2024

droideck commented Dec 20, 2024

progier389 left a comment

tbordaz left a comment

Firstyear left a comment

Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins #6447

Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins #6447

Conversation

droideck commented Dec 12, 2024

Firstyear left a comment

Choose a reason for hiding this comment

Firstyear Dec 12, 2024

Choose a reason for hiding this comment

droideck Dec 12, 2024

Choose a reason for hiding this comment

droideck Dec 17, 2024

Choose a reason for hiding this comment

tbordaz left a comment

Choose a reason for hiding this comment

tbordaz left a comment

Choose a reason for hiding this comment

droideck commented Dec 20, 2024

droideck commented Dec 20, 2024

progier389 left a comment

Choose a reason for hiding this comment

tbordaz left a comment

Choose a reason for hiding this comment

Firstyear left a comment

Choose a reason for hiding this comment