AD/LDAP Password as a SAML Attribute

[Cantor, Scott]

On 3/18/15, 3:12 PM, "Beadles, Mark A." <mbeadles at oar.net> wrote:

>In AD you have the choice (per user or per domain) of storing passwords either hashed or “reversibly encrypted”. The option for “reversibly encrypted” is there
> to support legacy authentication protocols like CHAP. If you choose “reversibly encrypted” then it is possible to retrieve the password.

And failing that, you have the mechanism of capturing it during login and caching it in the user Subject. Which I guess we sort of supported "officially" in V2, unbeknownst to me, but that feature didn't make it into V3 so far (thread earlier today). It can be done with some custom work.

-- Scott