AVI Controller Admin User Login Fails Due to Users credentials have expired

Products

• VMware Avi Load Balancer

Issue/Introduction

This article addresses a specific issue where the local 'admin' user on an AVI Controller is unable to log in to the UI and is blocked due to expired credentials after credentials_timeout_threshold expire. While LDAP user logins remain functional and UI access for those users is uninterrupted, the 'admin' user encounters an "User credentials have expired" error on UI login attempts.

Environment

• AVI Controller Authentication

• Local 'admin' user account

• User-Account-Profile with a credentials_timeout_threshold

 

 

Cause

• The root cause of this issue is the expiration of the local 'admin' user's password, as defined by the credentials_timeout_threshold parameter within the Default-User-Account-Profile. The provided profile snippet confirms "credentials_timeout_threshold": 180, meaning the password for local accounts associated with this profile expires every 180 days.

Resolution

To successfully resolve the "User credentials have expired" error and restore full access for the 'admin' user, the password must be changed using the UserAccount API. This method ensures that the credential expiration flag is properly cleared, allowing UI login and CLI configuration.

• Step1: Log in to the Controller CLI as the admin user (you will still be blocked from shell commands immediately after login, but this initial login is required for sudo).

  admin@:~$ sudo -i
  [sudo] password for admin: <Enter-Current-Admin-Password>
  

  This will grant you root access, indicated by the prompt changing to root@<Controller-IP>:~#.

• Execute the API Call to Change Password: Use the curl command to send a PUT request to the /api/useraccount endpoint. Replace <Controller-IP>, Current-Password, and New-Password with your specific details. Ensure Current-Password is the current password for the admin account (even if expired).
  
  

  root@:~# curl -k -u admin:Current-AdminUser-Password -X PUT https://<Controller-IP>/api/useraccount --insecure -H "Content-Type: application/json" -H "X-Api-Version: <Controller-Version>" -d '{"full_name":"System Administrator","name":"admin","username":"admin","email":"","local":true,"is_superuser":true,"old_password":"Current-Password","password":"New-Password","confirm_password":"New-Password"}'
  

   

  • -k or --insecure: Allows insecure server connections when using SSL/TLS (disables certificate verification). Use with caution in production, but often necessary for initial API access on controllers without trusted certificates.

  • -u admin:Current-Password: Specifies the username and current password for authentication.

  • -X PUT: Specifies the HTTP method as PUT, used for updating resources.

  • -H "Content-Type: application/json": Sets the request header to indicate that the body content is JSON.

  • -H "X-Api-Version: ": Specifies the API version. Adjust this if your Controller version is different.

  • -d '...': Provides the JSON payload containing the user details, including old_password, password, and confirm_password.

• Verify Access: After the curl command completes successfully (you should receive a JSON response indicating success, not an error), you should be able to:

  • Log in to the AVI Controller UI using the admin username and the New-Password.

    • Access the CLI shell without the "Your password has expired. Configuration is now blocked." message, allowing full command execution.

Note: Please refer the KB Article to Reset AVI Controller Admin User Login when credentials have expired when Basic Authentication option not enabled

Additional Information

• The credentials_timeout_threshold in the User Account Profile is a security feature designed to enforce regular password changes for local user accounts.
• While the admin_pwd_reset.py script can technically change the password, it appears to miss updating the internal flag that indicates the password has also been changed since its expiration, which is crucial for full system access.
• The API method, on the other hand, correctly clears this flag, thereby resolving the UI login and CLI blocking issues. This highlights the importance of using the appropriate API calls for comprehensive system management and state changes in AVI Controller.