1

I have a user database in MySQL format on my web server. The user passwords are encrypted by php with bcrypt. We want to import them into Active Directory without requiring the users to change their passwords.

I looked around the Internet and I can't find anything that would indicate this is possible. All the password import stuff I could find for AD assumes plaintext passwords.

Is there a way to import bcrypt passwords into AD and have them work?

Improve this question
1
  • Bonus Chatter: Active Directory stores passwords as an unsalted MD4 hash.
    – Ian Boyd
    Commented Apr 29, 2020 at 15:16

1 Answer 1

Reset to default
3

AD only uses LM and NTLM password hashes for domain authentication. You won't be able to import the bcrypt hashes and have them work to authenticate users to the domain.

You could modify your web app authentication process to temporarily capture the plaintext password when a user successfully logs in and create a corresponding AD user account for them with that password. This assumes you have time to wait for the majority of your users to log in before they start using the AD. Anyone who doesn't log in during that time wouldn't have an AD account.

Improve this answer
1
  • You answered my question and came up with a brilliant workaround... score!
    – theglossy1
    Commented Dec 1, 2016 at 22:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .