Managing Non-Reversible Password Storage

Always Store Password Reversibly Option

The Always Store Password Reversibly option controls how a user's password is stored in the system.

• Enabled — The user's password is stored in a reversible (encrypted) format.
• Disabled — The user's password is stored in a non-reversible (hashed) format when the Non-Reversible Password (NRP) feature is enabled.

Reversible password storage allows the system to retrieve the original password when required by specific features or authentication mechanisms. Non-reversible password storage stores only the hash value of the password, and the original password cannot be recovered.

The Always Store Password Reversibly option is disabled by default.

Identifying Password Storage Type

Password storage behavior can be identified using the user flags shown in the Local Users database.

Password Storage Flags:

Flag	Meaning
6	Password is stored reversibly (encrypted)
d	Password is stored non-reversibly (hashed)

For example, for user demo1:

• Flag value 6 indicates that the password is stored in reversible (encrypted) format.
• Flag value d indicates that the password is stored in non-reversible (hashed) format.

User-Level vs Group-Level Password Storage Priority

Password storage settings follow user-level precedence over group-level configuration.

Example Scenario:

1. Create a local user named demo1.
2. Enable Store Password Non-Reversibly for the user.

   The password for demo1 is now stored as a hash (non-reversible).

3. Create a group named Group1.
4. Enable Always Store Member Users' Passwords Reversibly on Group1.
5. Add demo1 to Group1.

Result: Even though Group1 is configured to store member passwords reversibly:

• The password for demo1 continues to be stored as non-reversible (hashed).
• The group-level setting does not override the user's existing password storage state.

To Change the Password to Reversible Storage:

1. Edit user demo1.
2. Enable Always Store Password Reversibly at the user level.
3. Change/reset the user's password.

After the password is changed, it will be stored in reversible (encrypted) format.

Merely enabling the reversible password option does not convert existing stored passwords. The password must be changed after enabling the setting for the new storage format to take effect.

CLDR Behavior with Non-Reversible Passwords (NRP)

When the Non-Reversible Password (NRP) feature is enabled, periodic Common Credential Discovery and Reporting (CLDR) verification cannot be performed for Local Users. CLDR checks for Local Users can only occur during the user authentication/login process.

1. Password Hash Generation Includes a Random Value
   1. For each Local User, the NRP hash is generated using:
      1. The user's password
      2. An 8-byte randomly generated value (salt)

      As a result:

      1. The stored hash cannot be used to determine the original password.
      2. The CCDB (Common Credential Database) contains only password values and does not contain the random salt value required to generate the same hash.
      3. Therefore, periodic comparison of stored NRP hashes against the CCDB database is not possible.
2. Plain Text Password Is Available During Login
   1. During the login process:
      1. The user provides the password in plain text.
      2. The plain text password can be checked against the CCDB database.
      3. CLDR validation can therefore be performed at login time.

Because the original password is only available during authentication, CLDR verification for Local Users with NRP enabled is limited to user login events and cannot be executed through periodic background scans.