PBKDF2 password encryption warnings and error messages during server startup

Edit online

The PBKDF2 password encryption algorithm might generate some warnings or errors which you can use to troubleshoot configuration issues.

  • If GSKit version is older than 8.0.50.88, a warning message is logged in the traceibmslapd.log file.

    Upgrade GSKit version to 8.0.50.88 or later to use any of the PBKDF2 encryption mechanisms.

  • If ibm-slapdPwEncryption is set to the PBKDF2 algorithm, and the GSKit version is older than 8.0.50.88, the server will start in configuration only mode with the ERROR message GLPSRV134I in ibmslapd.log.

    On the console, upgrade GSKit to 8.0.50.88 or later to set PBKDF2 algorithm for ibm-slapdPwEncryption.

  • If ibm-slapdUseNonFIPSCrypt is missing (default) or not set to TRUE and ibm-slapdPwEncryption is set to any of PBKDF2 algorithm, then, server will start in configuration only mode.

    The ERROR message GLPSRV134I is displayed on the console.

    In ibmslapd.log, the following message is logged:

    ERROR: Set ibm-slapdUseNonFIPSCrypt to TRUE in cn=Configuration entry to set any of PBKDF2 password encryption algorithm for ibm-slapdPwEncryption.

  • Minimum allowed value for ibm-slapdPBKDFNumIterations is 1000 and the maximum allowed value for ibm-slapdPBKDFNumIterations is 10000000.

    The server sets a default value of 10000, if the provided value is invalid or is not in allowed limit.

    The server displays the GLPSRV134I warning message on the console and in the ibmslapd.log file about default value usage.