Showing posts with label Access. Show all posts
Showing posts with label Access. Show all posts

Reset Oracle Directory Manager's Password


Have you ever had situation that you needed to execute a command for  Oracle Directory Server which required root/Directory Manager's password and the password you had just did not work? I encountered one today and had to scramble to find a solution to reset it. 'pwdhash' tool that comes with Oracle Directory Server rescued me. Here is what I did:
  1. Before resetting the password, you may want to try few of your guesses. Here is how you do it. Get the actual root/Directory Manager's password from dse.ldif file. It's with attribute 'nsslapd-rootpw:' something like: nsslapd-rootpw: {SSHA256}WYChc/pNA34fD8RKo//ReBCsGstkz0Ux54gfsMaruXhMP89tAnMtd
  2. Then compare each of your guess with the encrypted password from dse.ldif using 'pwdhash'. It has option to compare '-c'. Below is how you do it. If password matches, you'll get message "password ok." otherwise "password does not match." is displayed.

    ./pwdhash -D <instance-location> -c "<encrypted-password>" <your-guess-password>
    # Actual example from my ODS instance
    $>cd
    /opt/ods/dsee7/bin
    $>./pwdhash -D /opt/ods/dsee7/instances/dsInst2 -c "{SSHA256}WYChc/pNA34fD8RKo//ReBCsGstkz0Ux54gfsMaruXhMP89tAnMtd" myPassw0rd
    ./pwdhash: password does not match.
     
  3. If none of your guess matches then it's time to reset the password hard way. Here is how to do it:
    # Stop your Oracle Directory Instance
    $>cd /opt/ods/dsee7/bin
    $>./dsadm stop /opt/ods/dsee7/instances/dsInst2
    Directory Server instance '/opt/ods/dsee7/instances/dsInst2' stopped

    # Generate the encrypted password
    $>./pwdhash -D /opt/ods/dsee7/instances/dsInst2 -s SSHA256 myPassw0rd
    {SSHA256}qOjAyposbx1LzM/LB4vk1ZKS2yNs2Oh0yDjo66GIjnMpIVMJMhi6fw==
     
  4. Take the generated encrypted password from step #3 and replace the value of attribute 'nsslapd-rootpw:' in dse.ldif file and save it.
  5. Restart the Oracle Directory Instance.
    # Start your Oracle Directory Instance
    $>cd /opt/ods/dsee7/bin
    $>./dsadm start /opt/ods/dsee7/instances/dsInst2
    Directory Server instance '/opt/ods/dsee7/instances/dsInst2' started: pid=2982
     

That's it, password reset is done in hard way!!!

However in future, if you just want to change the root/Directory Manager's password, you can use the 'dsconf' command with 'set-server-prop' option. Below is more detail:
# Put new password in a temporary file.
$>echo "_0d3mG4_" > /tmp/odspwd.txt
# Now run the 'dsconf' command. You need to provide current password for Directory Manager when it prompts
$>./dsconf set-server-prop -h localhost -p 1489 root-pwd-file:/tmp/odspwd.txt
Enter "cn=Directory Manager" password: