freeipa

#6857 ipa_pwd.c: Use OpenSSL instead of NSS for hashing
Closed: fixed by abbra. Opened by cheimes.

Closed: fixed
Reopen Issue

Given the fact that FreeIPA no longer uses python-nss and libcurl is moving away from NSS to OpenSSL, it makes sense to remove NSS from ipaclient. Once libxmlrpc_client uses an OpenSSL based libcurl, the password hashing code in ipa_pwd.c is the only dependency that pulls in NSS for client libs.

Possible solutions:
* Reimplement the hashing code with OpenSSL
* Refactor libutil and move ipa_pwd.c out. The functions ipapwd_generate_new_history and ipapwd_check_policy are not used by client libraries.

Metadata Update from @pvoborni:
- Issue priority set to: minor
- Issue set to the milestone: FreeIPA 4.7
- Issue tagged with: refactoring

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.7.1 (was: FreeIPA 4.7)

FreeIPA 4.7 has been released, moving to FreeIPA 4.7.1 milestone

master:

  • f2d854886fdaa4d61965c1af6c02060d816a1fbf util: add unit test for pw hashing
  • 68af4f39c19fb52fcf6ed674b883ee30026bdb4b util: replace NSS usage with OpenSSL

ipa-4-8:

  • 0fe645efc16995f159db31dc514c8a8e0e13c706 util: add unit test for pw hashing
  • 41a20fef10382a3d2c7f3260a8e0fba8a29d809a util: replace NSS usage with OpenSSL

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

NSS is still used for hashing in libotp.

Metadata Update from @cheimes:
- Issue set to the milestone: None (was: FreeIPA 4.7.1)
- Issue status updated to: Open (was: Closed)

https://github.com/freeipa/freeipa/pull/4780

master:

  • be47ec9799ef7708f181d1b20fc238f23539a9b0 libotp: Replace NSS with OpenSSL HMAC

ipa-4-8:

  • 47adde99c28d1f7da5180a29ebcd2d70158217b5 libotp: Replace NSS with OpenSSL HMAC

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

refactoring

None
None
High
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.