UCS LDAP-Passwort

[Grandjean]

@vargax

If I would have access to some form of the user’s hashed password (in Base64, unsalted MD5, or unsalted SHA-1 format), I could use GCDS to push passwords to G Suite.

I’m bringing this back up because I had a conversation with someone else who referred to this. I think vargax knows all of this by now, but for anyone coming back to this topic because of searching for plaintext passwords or password hashes:

• UCS does not store user passwords in plaintext
• Base64 is not a hashing algorithm, but an encoding (one can easily decode it. Hashes are only one-way)
• Unsalted MD5 and SHA1 hashes are considered broken and should be treated as a security risk

Regarding the original problem:

@vargax

In order to allow this engineers to authenticate to Google using SAML from an external location, the UCS login page must be reachable from the internet, which is what we would like to avoid.

I can understand those concerns, but I think it’s worth a second thought. I would rather expose the UCS SAML SSO Login page than syncing passwords that are either not encrypted (plaintext, base64) or use weak hashing algorithms (unsalted MD5/SHA1). To me, the latter sounds like a much more insecure choice.