title: How to ensure the security of admin password stored in database for synchronization with LDAP
body: <p>I have an application that needs to sync periodically to my directory service (OpenLDAP or AD).</p>
  
  <p>To do so, it is necessary to <em>bind</em> an <em>admin account</em> with a <strong>DN</strong> and <strong>password</strong>, to access users on LDAP. </p>
  
  <p>As far as I understand, there is the possibility of using <em>anonymous</em>, however for security reasons, its use is not recommended.</p>
  
  <p>Since this periodic synchronization is done <em>automatically by a routine</em> (hourly), I need to store in addition to the account DN, also admin password in the application database.</p>
  
  <p>However, passwords are usually sent to be authenticated in plaintext against 
  directory service (within a secure SSL / TLS connection) and the directory service itself that finds its password stored in plaintext or some hash (md5, sha-1, etc.)</p>
  
  <p>How to ensure the security of <em>admin password stored</em> in database for synchronization with LDAP? Or, is there a best practice to implement a sync periodic using LDAP?</p>
  
  <p>Applications examples that require password (admin) to read LDAP.</p>
  
  <ul>
  <li>Moodle
  (<a href="https://docs.moodle.org/37/en/LDAP_authentication#Bind_settings" rel="nofollow noreferrer">https://docs.moodle.org/37/en/LDAP_authentication#Bind_settings</a>)</li>
  <li>Sugar CRM  (<a href="https://support.sugarcrm.com/Knowledge_Base/Password_Management/Configuring_LDAP_Authentication_Using_Active_Directory/#Prerequisites" rel="nofollow noreferrer">https://support.sugarcrm.com/Knowledge_Base/Password_Management/Configuring_LDAP_Authentication_Using_Active_Directory/#Prerequisites</a>)</li>
  </ul>
  
  <p>But it does not clear how the <em>password</em> is stored.</p>