What does a value like userPassword: {SHA}fdowskjdap... tell you, and why does it matter for security?

The prefix in braces names the hashing scheme ({SHA}, {SSHA}, {CRYPT}, ...): the directory stores a password hash, not the password; an unsalted scheme such as {SHA} is weak because identical passwords give identical hashes and can be cracked fast offline.

The userPassword attribute (allowed by the person class) holds the credential that a simple bind is checked against. The scheme prefix tells the server how to verify a login attempt: hash the password the user typed with the same scheme and compare.

Why the scheme matters:

• {SHA} is a single unsalted SHA-1 hash. Two users with the same password have the same value, and precomputed tables or a GPU can test billions of guesses per second.
• {SSHA} adds a random salt, which defeats precomputed tables but is still fast to brute-force.
• Modern servers support slow, salted schemes (for example PBKDF2 or Argon2 modules), which are the right choice today.

The general lesson is that whoever can read userPassword (an over-broad access rule, an LDIF backup left on a share) gets material for offline cracking. Directories therefore restrict read access to this attribute so that only the bind operation itself can use it.

Go deeper:

• OpenLDAP Admin Guide: Security considerations — password storage schemes and how to protect userPassword.