Importing Active Directory User's Password in Auth0
Last Updated:
Overview
This article outlines steps and aspects to consider when importing Active Directory (AD) users' passwords into Auth0.
Applies To
- Bulk Import
- Password
- Active DIrectory
Cause
Active Directory (AD) stores user passwords as one-way hashes, primarily using the NT Hash algorithm. However, the unicodePwd attribute requires UTF-16LE encoding.
The NT Hash and the UTF-16LE encoding are not supported algorithms or encodings in Auth0. This will require a conversion to a JSON file where the password hash uses one of the supported algorithms and encoding. On login, the user-provided password will be transcoded password.encoding before being checked against the provided hash. By default, Auth0 uses UTF-8 if not specified.
Solution
When generating the JSON file to import AD users' passwords into Auth0, it is required to specify the password encoding to be "utf16le". If the field is left out, Auth0 will take the user's input, convert it to UTF-8, run MD4, for example, and get a completely different hash than the one you imported.
Below is an example of how the import file should look for an AD user's password.
Related Reference
