Is there a way to migrate an existing matrix-synapse user database to OpenLDAP?

Question

I am looking for a way to migrate a huge Synapse home server database to OpenLDAP without resetting the users' passwords. Migration to LDAP is necessary as we would like to integrate all our online services into each other

Therefore, I am looking for a way to make OpenLDAP understand Synapse's password hashes.

Synapses hashing algorithm is explained here:

pw = unicodedata.normalize("NFKC", password) hashed = bcrypt.hashpw( pw.encode('utf8') + password_pepper.encode("utf8"), bcrypt.gensalt(bcrypt_rounds), ).decode('ascii') 

Is it possible to implement such a hashing on OpenLDAP or any other open source LDAP server?

Answer 1

If bcrypt is a valid algorithm for the underlying system it should work as part of OpenLDAP's CRYPT password storage scheme.

If for instance your existing password hashes look like $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy you should be able to set the userPassword attribute OpenLDAP to {CRYPT}$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy and then authenticate.
(If you're doing this on the commandline make sure that the $text isn't interpreted as a shell variable before being input into the database.)