diff --git a/contrib/openldap/core-fd-conf.schema b/contrib/openldap/core-fd-conf.schema
index c702ec94f78c1bc4ceb09dc1caf0cba312e9bd7a..592390eb7934afb2c708c633bbbfb7aa566acc8d 100644
--- a/contrib/openldap/core-fd-conf.schema
+++ b/contrib/openldap/core-fd-conf.schema
@@ -202,6 +202,12 @@ attributetype ( 1.3.6.1.4.1.38414.8.13.8 NAME 'fdForcePasswordDefaultHash'
   SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
   SINGLE-VALUE )
 
+attributetype ( 1.3.6.1.4.1.38414.8.13.9 NAME 'fdPasswordAllowedHashes'
+  DESC 'FusionDirectory - Allowed password hashes'
+  EQUALITY caseExactIA5Match
+  SUBSTR caseExactIA5SubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+
 # Core settings
 
 attributetype ( 1.3.6.1.4.1.38414.8.14.2 NAME 'fdListSummary'
@@ -574,7 +580,7 @@ objectclass ( 1.3.6.1.4.1.38414.8.2.1 NAME 'fusionDirectoryConf'
     fdAclRoleRDN $ fdCnPattern $ fdRestrictRoleMembers $ fdSplitPostalAddress $ fdPostalAddressPattern $
     fdPasswordDefaultHash $ fdPasswordMinLength $ fdPasswordMinDiffer $
     fdHandleExpiredAccounts $ fdSaslRealm $ fdSaslExop $
-    fdForcePasswordDefaultHash $
+    fdForcePasswordDefaultHash $ fdPasswordAllowedHashes $
     fdListSummary $
     fdModificationDetectionAttribute $ fdLogging $ fdLdapSizeLimit $ fdWildcardForeignKeys $
     fdLoginAttribute $ fdForceSSL $ fdWarnSSL $ fdStoreFilterSettings $ fdSessionLifeTime $
diff --git a/include/password-methods/class_passwordMethod.inc b/include/password-methods/class_passwordMethod.inc
index 28421f0f51d5ca831770a4433648d4f920b1a0e9..42abc4a33190e9a629ffac1fdf66ecf46fbb260e 100644
--- a/include/password-methods/class_passwordMethod.inc
+++ b/include/password-methods/class_passwordMethod.inc
@@ -238,20 +238,17 @@ abstract class passwordMethod
             }
 
             $cfg  = $test->is_configurable();
-            $desc = $test->get_description();
 
             foreach ($plugs as $plugname) {
               $ret['name'][$i]            = $plugname;
               $ret['class'][$i]           = $class;
               $ret['is_configurable'][$i] = $cfg;
               $ret['object'][$i]          = $test;
-              $ret['desc'][$i]            = $desc;
 
               $ret[$i]['name']            = $plugname;
               $ret[$i]['class']           = $class;
               $ret[$i]['object']          = $test;
               $ret[$i]['is_configurable'] = $cfg;
-              $ret[$i]['desc']            = $desc;
 
               $ret[$plugname]             = $class;
               $i++;
@@ -264,14 +261,6 @@ abstract class passwordMethod
     return session::get('passwordMethod::get_available_methods');
   }
 
-  /*!
-   * \brief Get desciption
-   */
-  function get_description (): string
-  {
-    return '';
-  }
-
   /*!
    * \brief Method to check if a password matches a hash
    */
diff --git a/plugins/config/class_configInLdap.inc b/plugins/config/class_configInLdap.inc
index 1fb855e3df3d838cb89d144e47cf882d7d88b065..4d964f4004e73da3b1399571e3d2061a56edacd1 100644
--- a/plugins/config/class_configInLdap.inc
+++ b/plugins/config/class_configInLdap.inc
@@ -120,6 +120,13 @@ class configInLdap extends simplePlugin
       'password' => [
         'name'  => _('Password settings'),
         'attrs' => [
+          new SetAttribute(
+            new SelectAttribute(
+              _('Allowed password hashes'), _('Password hashes which may be used for user passwords'),
+              'fdPasswordAllowedHashes', TRUE,
+              ['ssha']
+            )
+          ),
           new SelectAttribute(
             _('Password default hash'), _('Default hash to be used'),
             'fdPasswordDefaultHash', TRUE,
@@ -381,7 +388,10 @@ class configInLdap extends simplePlugin
     if (!in_array('sasl', $methods)) {
       $methods[] = 'sasl';
     }
-    $attributesInfo['password']['attrs'][0]->setChoices($methods);
+    $attributesInfo['password']['attrs'][0]->attribute->setChoices($methods);
+    $attributesInfo['password']['attrs'][0]->setDefaultValue($methods);
+    $attributesInfo['password']['attrs'][0]->resetToDefault();
+    $attributesInfo['password']['attrs'][1]->setChoices($methods);
     /* Login methods */
     $methods = LoginMethod::getMethods();
     $attributesInfo['login']['attrs'][4]->setChoices(array_keys($methods), array_values($methods));
@@ -496,6 +506,10 @@ class configInLdap extends simplePlugin
         $this->fdLoginMethod = 'LoginHTTPHeader';
       }
     }
+
+    $this->attributesAccess['fdPasswordDefaultHash']->setChoices(
+      $this->attributesAccess['fdPasswordAllowedHashes']->getValue()
+    );
   }
 
   function compute_dn (): string
@@ -512,6 +526,15 @@ class configInLdap extends simplePlugin
     return $messages;
   }
 
+  function save_object ()
+  {
+    parent::save_object();
+
+    $this->attributesAccess['fdPasswordDefaultHash']->setChoices(
+      $this->attributesAccess['fdPasswordAllowedHashes']->getValue()
+    );
+  }
+
   static function get_themes ()
   {
     $themesdir  = '../ihtml/themes/';
diff --git a/plugins/personal/generic/class_UserPasswordAttribute.inc b/plugins/personal/generic/class_UserPasswordAttribute.inc
index a6177a9d95ec7695820289c1de7e6520be08c314..0fff1600c4514fa782b952a05372ef2b6036f494 100644
--- a/plugins/personal/generic/class_UserPasswordAttribute.inc
+++ b/plugins/personal/generic/class_UserPasswordAttribute.inc
@@ -26,17 +26,15 @@ class UserPasswordAttribute extends CompositeAttribute
 
   function __construct ($label, $description, $ldapName, $required = FALSE, $defaultValue = "", $acl = "")
   {
+    global $config;
+
     $temp = passwordMethod::get_available_methods();
 
     /* Create password methods array */
-    $pwd_methods = [];
+    $pwd_methods        = $config->get_cfg_value('PasswordAllowedHashes', $temp['name']);
     $this->needPassword = [];
     foreach ($temp['name'] as $id => $name) {
       $this->needPassword[$name] = $temp[$id]['object']->need_password();
-      $pwd_methods[$name] = $name;
-      if (!empty($temp[$id]['desc'])) {
-        $pwd_methods[$name] .= " (".$temp[$id]['desc'].")";
-      }
     }
 
     parent::__construct(
@@ -45,7 +43,7 @@ class UserPasswordAttribute extends CompositeAttribute
         new SelectAttribute(
           _('Password method'), _('Password hash method to use'),
           $ldapName.'_pwstorage', TRUE,
-          array_keys($pwd_methods), '', array_values($pwd_methods)
+          $pwd_methods
         ),
         new PasswordAttribute(
           _('Password'), _('Password (Leave empty if you do not wish to change it)'),