Reset Oracle Directory Manager's Password

Have you ever had situation that you needed to execute a command for  Oracle Directory Server which required root/Directory Manager's password and the password you had just did not work? I encountered one today and had to scramble to find a solution to reset it. 'pwdhash' tool that comes with Oracle Directory Server rescued me. Here is what I did:

1. Before resetting the password, you may want to try few of your guesses. Here is how you do it. Get the actual root/Directory Manager's password from dse.ldif file. It's with attribute 'nsslapd-rootpw:' something like: nsslapd-rootpw: {SSHA256}WYChc/pNA34fD8RKo//ReBCsGstkz0Ux54gfsMaruXhMP89tAnMtd
2. Then compare each of your guess with the encrypted password from dse.ldif using 'pwdhash'. It has option to compare '-c'. Below is how you do it. If password matches, you'll get message "password ok." otherwise "password does not match." is displayed.
   

   ./pwdhash -D <instance-location> -c "<encrypted-password>" <your-guess-password> # Actual example from my ODS instance $>cd /opt/ods/dsee7/bin $>./pwdhash -D /opt/ods/dsee7/instances/dsInst2 -c "{SSHA256}WYChc/pNA34fD8RKo//ReBCsGstkz0Ux54gfsMaruXhMP89tAnMtd" myPassw0rd ./pwdhash: password does not match.

3. If none of your guess matches then it's time to reset the password hard way. Here is how to do it:
   

   # Stop your Oracle Directory Instance $>cd /opt/ods/dsee7/bin $>./dsadm stop /opt/ods/dsee7/instances/dsInst2 Directory Server instance '/opt/ods/dsee7/instances/dsInst2' stopped # Generate the encrypted password $>./pwdhash -D /opt/ods/dsee7/instances/dsInst2 -s SSHA256 myPassw0rd {SSHA256}qOjAyposbx1LzM/LB4vk1ZKS2yNs2Oh0yDjo66GIjnMpIVMJMhi6fw==

4. Take the generated encrypted password from step #3 and replace the value of attribute 'nsslapd-rootpw:' in dse.ldif file and save it.
5. Restart the Oracle Directory Instance.
   

   # Start your Oracle Directory Instance $>cd /opt/ods/dsee7/bin $>./dsadm start /opt/ods/dsee7/instances/dsInst2 Directory Server instance '/opt/ods/dsee7/instances/dsInst2' started: pid=2982

That's it, password reset is done in hard way!!!

However in future, if you just want to change the root/Directory Manager's password, you can use the 'dsconf' command with 'set-server-prop' option. Below is more detail:

# Put new password in a temporary file. $>echo "_0d3mG4_" > /tmp/odspwd.txt # Now run the 'dsconf' command. You need to provide current password for Directory Manager when it prompts $>./dsconf set-server-prop -h localhost -p 1489 root-pwd-file:/tmp/odspwd.txt Enter "cn=Directory Manager" password: