The OpenLDAP documentation provides some sample code in the FAQ which you can use to create custom scripts in your favourite scripting language to convert clear text passwords to SSHA.
Note: Please don't use the same salt for all your users.
Export (parts of) your directory to directory to LDIF format with slapcat and script away!
For a small number of clear text passwords you could simply generate an LDIF to update them:
dn: cn=Alice, ou=Users, o=example, c=com
changetype: modify
replace: userPassword
userPassword: {SSHA}xxxxxxxxxxxxxxxx
dn: cn=Bob, ou=Users, o=example, c=com
changetype: modify
replace: userPassword
userPassword: {SSHA}abcabcabcbacbabcabc
You might want to spin up a test server and benchmark how long updating with an LDIF takes. AFAIK there are no indexes on the password field so performance might be sufficient for your purposes, but typically going through the LDAP interface is relatively slow (and slower still when many indexes have to be updated as well). One of the advantages is that using an LDIF will follow your replication structure.
Typically modifying the database in it's off-line state is much faster. Again make an export with slapcat, convert the clear text userPassword:
fields in the resulting LDIF and use slappadd
to reload it. Maybe with -q
and -s
switches. How well that mixes with (multi-master) replication, depends a bit on your intended approach.
This Q&A might be of interest in deciding on an approach as well.