Re-enable the built-in administrator

Re-enable the built-in administrator account if external identity providers fail or policy misconfiguration locks out all administrators.

Procedure
Copy link

  1. Log in as an administrator.
  2. Navigate to System Administration > Access Management > Users.
  3. In the Built-in Administrator Account card, set the toggle to Enabled.

Results
Copy link

If no administrators can log in, use the automation-orchestrator-admin CLI from inside the application pod. For details, see Recover access with the automation-orchestrator-admin CLI.

What to do next
Copy link

Navigate to the automation orchestrator URL and select Log in. Log in with the built-in administrator credentials to confirm the account is active.

Recover access with the automation-orchestrator-admin CLI
Copy link

Re-enable a locked-out user account or reset a password from inside the application pod when no administrators can log in through the UI.

Before you begin
Copy link

  • Access to the OpenShift cluster with oc and permissions to execute commands in the automation orchestrator namespace.

Procedure
Copy link

  1. Re-enable the built-in administrator account: 
    $ oc exec -n namespace deploy/cr-name-backend -- \
    ao-admin enable-user --username admin

    To re-enable a different user, replace admin with their username.

    The command revokes all existing sessions for the user and increments the token version, forcing re-authentication.

  2. Optional: Reset the built-in administrator password: 
    $ oc exec -n namespace deploy/cr-name-backend -- \
    ao-admin reset-password --username admin

    The command prompts for a new password. It rejects identity provider users. The new password must meet the same complexity requirements as passwords set through the API (minimum 14 characters, at least 3 of 4 character classes). All sessions are revoked and the token version is incremented.

    To reset a different user's password, replace admin with their username.

Results
Copy link

Navigate to the automation orchestrator URL and select Log in. Log in with the re-enabled account credentials to confirm the account is active.