Error: Root account locked or password expired on Workspace ONE Access (WSA) - VMware Identity Manager 3.3.x
search cancel

Error: Root account locked or password expired on Workspace ONE Access (WSA) - VMware Identity Manager 3.3.x

book

Article ID: 376435

calendar_today

Updated On:

Products

VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

This article provides procedures to reset a forgotten or expired root account password for Workspace ONE Access (WSA) / VMware Identity Manager 3.3.x appliances. This issue commonly occurs due to password expiration policies or multiple failed login attempts. In VMware Cloud Foundation (VCF) environments, performing a local reset will cause credential drift from the SDDC Manager database. See the Resolution section for synchronization steps.

If the password has expired and you know the expired password please follow the steps in How to change Expired Password for "root" and "sshuser" in VMware Identity Manager

Environment

  • VMware Identity Manager 3.3.x
  • VMware Cloud Foundation (VCF) / SDDC Manager

Cause

The root account password has expired, the account is locked due to numerous failed attempts, or the /var partition is full.

Resolution

Prerequisites

  • Take an offline snapshot of the SDDC Manager and all WSA/Identity Manager nodes before proceeding.
  • Important for VCF Environments: After resetting the root password locally via the steps below, you must perform the 'Remediate' operation within the SDDC Manager UI to re-establish management plane synchronization. Failure to do so will result in management plane drift and 'Disconnected' status in SDDC Manager.

Procedure:

Note: If completing the steps on a 3 node vIDM cluster it is important to start with the primary node.

Follow below procedure for GRUB version 2.0 and above:

  1. Restart VMware Identity Manager appliance and wait for the Photon OS Splash screen during boot.

2. Enter 'e' to go to GNU GRUB boot menu editor:

3. Locate the line beginning with linux and append init=/bin/bash to the end of that line..

4. Press F10 to boot with these parameters.

5. Remount the partition as Read-Write: mount -o rw,remount /

6. Reset the password: passwd root

7. Validate the root account is not locked out and unlock if necessary:

To check the status of root account: 

pam_tally2 -u root

If root account is locked, run:

pam_tally2 -u root --reset

NOTE: If pam_tally2 is not present on the appliance use faillock instead (faillock -u root; faillock -u root --reset)

 

8. Reboot the appliance with " reboot -f " command.

 

Follow below Procedure for GRUB version 0.97:

To reset root account password from single user mode

  1. Reboot from vCenter console, press p or e at the bootloader prompt.
  2. When prompted for a password, enter: H0rizon!
  3. Select the boot option starting with Kernel and press e.
  4. Add rw init=/bin/bash to the end of the line and press Enter.

5. Press b to boot into single-user mode.

6. Reset the password: passwd root

7. Reboot the appliance: reboot -f

After Reset (VCF Environments Only):

  1. Navigate to the SDDC Manager UI.
  2. Locate the WSA/Identity Manager instance.
  3. Execute the 'Remediate' action to align the management plane with the updated root credentials.

Additional Information

Powered by Wolken Software