Why does ADAudit Plus force the password algorithm to bcrypt even if another algorithm is specified?
The code in `AuthUtil.createUserAccount()` checks if the algorithm is not "bcrypt" and logs an info message, then overrides the algorithm to bcrypt. This ensures all passwords are hashed with the strong, adaptive bcrypt algorithm for better security. This enforcement is noted in the ADAudit Plus Analysis - Data Encryption Analysis article.
algorithm enforcementbcrypt overridesecuritypassword policyAuthUtil