SLAPPW-ARGON2(5)

📦
version 2.7.2 · 24 versions
, in arch rolling

✨ SLAPPW-ARGON2 ✨

okay bestie, so this is slappw-argon2, aka the Argon2 password module for slapd, and it lives in the File Formats Manual section. 💖 It's page 5 of the manual, in case you were wondering which shelf to find it on.

🌸 NAME 🌸

slappw-argon2 — the Argon2 password module for slapd. that's it, that's the name, and yes it's a mouthful, we deal.

🎀 SYNOPSIS 🎀

/etc/openldap/slapd.conf

       moduleload argon2 [<parameters>]

so you're chilling in /etc/openldap/slapd.conf and you drop a moduleload argon2 line, optionally with <parameters> trailing behind like a little entourage. 💅

🦋 DESCRIPTION 🦋

okay so real talk: the argon2 module is here to give slapd(8) support for the key derivation function Argon2, which — no cap — won the Password Hashing Competition back in July 2015. 👑 iconic behaviour. and we use it for hashed passwords in OpenLDAP.

how does it do that, you ask? it literally just hands you an extra password scheme — {ARGON2} — to use inside slapd. that's the whole vibe. 💖

🌈 CONFIGURATION 🌈

bestie, here's the gag: the argon2 module doesn't need any configuration. it's low maintenance, highkey a dream. but if you want to configure it, you can, by giving it these parameters:

  • m=<memory> — set memory usage to <memory> kiB. memory queen. 💾
  • p=<parallelism> — set parallelism to <parallelism> threads. heads up though: currently supported only when linked with libargon2. so if you're not linked with it, this one's just standing there looking pretty. 🙈
  • t=<iterations> — set the number of iterations to <iterations>. the more times you go around, the more effort it takes. 🔁

where possible, these replace the defaults when preparing hashes for new passwords. so they're not just decorative, they actually eat. ✨

so after you load the module, the password scheme {ARGON2} gets recognised in values of the userPassword attribute. hello? that's the whole point and it's serving. 🫶

then you can tell OpenLDAP to use this scheme when it's processing the LDAPv3 Password Modify (RFC 3062) extended operations by using the password-hash option in slapd.conf(5), like:

password-hash {ARGON2}

💜 NOTES 💜

quick side quest: if you wanna use the scheme described here with slappasswd(8), remember to load the module using its command line options. don't forget, bestie, because it will simply not work and you will be sad. 😭

the relevant option/value is:

-o module-load=argon2

or, if you need those non-default parameters:

-o module-load="argon2 [<param>...]"

and depending on where argon2 is actually located on your system, you might also need:

-o module-path=pathspec

path stuff, iykyk. 🧚

⭐ EXAMPLES ⭐

okay here's the good part. both userPassword LDAP attributes below encode the password 'secret' using different salts — so they're the same password but not the same hash, which is exactly the point, and honestly? slay. 🔥

userPassword: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$c2FsdHNhbHQ$DKlexoEJUoZTmkAAC3SaMWk30El9/RvVhlqGo6afIng

userPassword: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$c2FsdHNhbHRzYWx0$qOCkx9nMeFlaGOO4DUmPDgrlUbgMMuO9T1+vQCFuyzw

look at those little salt differences. 👑 chef's kiss.

💖 SEE ALSO 💖

go read them, they're all besties with this page. 🫶

🌸 ACKNOWLEDGEMENTS 🌸

this manual page was written by Peter Marschall, based on the module's README file written by Simon Levermann. giving credit where credit is due, periodt. 💅

OpenLDAP is developed and maintained by The OpenLDAP Project. and plot twist: OpenLDAP is derived from University of Michigan LDAP 3.3 Release. lore. 📜

and that's the whole page, bestie! this was page SLAPPW-ARGON2(5), sitting all cozy inside the File Formats Manual, brought to you by OpenLDAP 2.7.2 and dated 2026/10/21. love that for us. bye, stay hashed, stay salted! 🎀💜🦋

📦 where this page comes from