change of plan-storage-pwd (of SHA CRYPT)

Greetings;

My pwd-storage-system (world policy) is set to the CRYPT, I am obliged now to change that for SHA.

Most of my clients are Solaris, with a few RHEL (various flavors).

What is the best way to make the above change?

What are the effects, if any, will have on my UNIX clients?

In addition, my pwd-compat-mode is set to 'DS6-migration-mode', and I need to change this to 'DS6-mode', this would cause problems for me?

I only have DS6 servers in my environment, no DS5 at all and no other DS servers, although at one point I can want to synchronize with AD.

Thank you all,


Hello

(Unix) Crypt is a one-way function, text password is required to generate the SHA hash.

You can change the schema of SHA password storage, but passwords will be stored with SHA when users update their passwords. To expedite the process, you can configure the password expires or force users to change their password. Note that users with passwords stored in crypt format will always be able to authenticate even if the password storage scheme is set to SHA. In other words, different password storage systems can coexist in all existing entries. Over time, he will have to remember each password with the storage scheme of password configured as users update the passwords.

Password Ds6 strategy mode introduced new operational attributes in the user input. These new attr are generated when passwords are changed, in order to have a complete password strategy based on ds6-mode, you should 1 / 2 migration mode / I have users update their passwords 3 / mode ds6. This action of admin is somehow the CRYPT/SHA switch which already punish password changes.

Note that there is a tool provided with ODSEE11gr2 which generates the appropriate operational password policy attr without requiring users to change their password. This could be an alternative solution if you have the right to use this version.

HTH

-Sylvain

Tags: Fusion Middleware

Similar Questions

Maybe you are looking for