Migrate users from qmail to sun messaging (import MD5 hashed passwords)

Question

Hi,
we are planning to migrate about 2000 users from our current mail system (qmail + openldap) to Sun Messaging 6.2.
We have encountered a problem with user password migration. In our current ldap user passwords are MD5 encrypted, but it appears as Directory 5.2 does not support MD5 encryption method.
This is what I have found :
http://docs.sun.com/source/817-7616/config.html#wp26092
The following encryption types are supported by Directory Server:
* SSHA (Salted Secure Hash Algorithm) is the recommended method as it is the most secure.
* SHA (Secure Hash Algorithm). This is the method supported by 4.x Directory Servers.
* CRYPT is the UNIX crypt algorithm. It is provided for compatibility with UNIX passwords.
* If this attribute is set to CLEAR, passwords are not encrypted and appear in plain text.
We want to import MD5 hashed passwords so users can use their old password after we migrate to SUN, but as passwords are updated they will be SSHA hashed.
We only have a problem with importing MD5 hashed passwords in ldap directory.
Current password on openLDAP are created with the following PHP code:
$info["userPassword"]= '{md5}' . base64_encode(pack('H*', md5($passwd)));
I have tried to copy userpassword value from openldap to directory but the directory ignores {md5} and hashed the string again using SSHA.
Example:
cleartextpass: password
md5_base64_hash={MD5}X03MO1qnZdYdgyfeuILPmQ==
after ldap modify userpassword field loks like this:
userpassword:{SSHA}a+dFsejrTGwQAgdU07kkgzWWOC16SiIW2UsPcQ==
What is the correct procedure to import MD5 hashed passwords in Sun Directory?
(NS-MTA-MD5 Password Storage Plug-In is enabled)

Answer 1

Sun Directory 5.2 has a plugin NT-MTA-MD5 which should enable users to authenticate with MD5 hashed passwords.
I have checked in cn=config and NS-MTA-MD5 plugin is enabled.
I have tried with {NS-MTA-MD5} prefix and still directory does not allow users to authenticate.
Example:
cleartextpass: foo
md5_base64_hash={NS-MTA-MD5}rL0Y20zC+Fzt72VPzMSk2A==
after ldap modify userpassword field loks like this( NS-MTA-MD5 is accepted by directory):
userpassword:{NS-MTA-MD5}rL0Y20zC+Fzt72VPzMSk2A==
but
ldap bind fails with "invalid credentials" error
We are using solaris 10 so I tried using the prefix {crypt} and it did not work. You said something about the right config in /etc/security/crypt.conf. Here is the content of my crypt.conf file:
1 crypt_bsdmd5.so.1
2a crypt_bsdbf.so.1
md5 crypt_sunmd5.so.1
This should be the right config "md5 crypt_sunmd5.so.1"
Am I missing something here?
Is there anything else I need to do to enable directory to use MD5 hashed passwords?
Maybe NS-MTA-MD5 plugin is not enough?