1

I have a user database in MySQL format on my web server. The user passwords are encrypted by php with bcrypt. We want to import them into Active Directory without requiring the users to change their passwords.

I looked around the Internet and I can't find anything that would indicate this is possible. All the password import stuff I could find for AD assumes plaintext passwords.

Is there a way to import bcrypt passwords into AD and have them work?

2

AD only uses LM and NTLM password hashes for domain authentication. You won't be able to import the bcrypt hashes and have them work to authenticate users to the domain.

You could modify your web app authentication process to temporarily capture the plaintext password when a user successfully logs in and create a corresponding AD user account for them with that password. This assumes you have time to wait for the majority of your users to log in before they start using the AD. Anyone who doesn't log in during that time wouldn't have an AD account.

  • You answered my question and came up with a brilliant workaround... score! – theglossy1 Dec 1 '16 at 22:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.