How to add user entries with password field in LDAP over HTTPS?

Question

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this.

An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user creation form can be provided as web service over HTTPS.

As per this mail chain, LDIF files should better have userPassword as plain text so that the LDAP server takes care of hashing.

Is it possible to get the userPassword as plain text, at the server-side, when the password is entered by an end user on client side with HTTPS being used ? Is it a good idea at all ?

Or should I leave it to the user to hash it in SSHA on client-side and give it to the server, which I would add in the LDIF file ?

Answer 1

Is it possible to get the userPassword as plain text, at the server-side, when the password is entered by an end user on client side with HTTPS being used ?

Yes. HTTPS is HTTP over TLS. TLS stands for Transport Level Security, and, as the name implies, encrypts the transport layer. That is, it's only designed to protect the data during its transfer over the network.

Generally there will be a TLS terminator (or SSL terminator) at the edge of your infrastructure; this software (or occasionally, hardware) decrypts the TLS encryption and passes the unencrypted underlying HTTP request on to the application server. So yes, this is possible, and common.