I'm working with an existing database where passwords are hashed like this:
DBMS_UTILITY.GET_HASH_VALUE(the_username || the_password, 1000000000, 1073741824)
I know that this is bad for various reasons (not a proper cryptographically safe hash and the algorithm oracle uses may change between versions). But that database exists and it's unlikely that we can get them to change this since they have lots of users and cannot simply switch to a proper hashing algorithm without having each of them re-enter or reset their password.
Now I need to use this database for LDAP authentication (based on OpenLDAP). Unfortunately there is no way to make OpenLDAP pass the plaintext password to the database (where I could then simply call the hashing function on the plaintext password). However, modifying the LDAP client would be possible, so if I could create the hash there everything would be fine.
I'd rather avoid connecting to the Oracle database to do this since that would require the Oracle client, database login data, etc. on that machine, too. Therefore I wonder if there is any information about the algorithm used by GET_HASH_VALUE()
available. I couldn't find anything on Google but maybe it's buried between all the somewhat unrelated results... In case the algorithm changed recently, the server version is 11.2.0.3.0.
all_source
rows fordbms_utility
and all I found was this: gist.github.com/ThiefMaster/f0b818f4d4514332e557 - I'm not familiar with Oracle but it looks very much like a prototype for a function defined somewhere else.