Reset the admin@System password for VCF Automation Provider Management UI using a break-glass procedure.

Products

• VCF Automation

Issue/Introduction

Unable to log into the VCF Automation Provider Management UI (https://<vcfa-fqdn>/provider) to manage the System organization, tenant organizations, or identity providers. One of the following applies:

• The admin@System credential has been lost or is unknown.
• The admin@System password has expired and the account is locked out.

Environment

VCF Automation 9.0.x, 9.1.x

Cause

The admin@System account is the built-in administrator of the VCF Automation (VCFA) System organization. If this credential is lost or expires, there is no self-service recovery path through the UI. Administrative access to the underlying platform is required to issue a reset.

Resolution

There is no resolution available in the currently shipped releases.

Workaround

Use the reset_system_admin_password.sh break-glass script to reset the admin@System password via the VCFA platform API. The script authenticates as [e-mail] (the VSP platform administrator), triggers a password reset task for the System organization admin account, polls until the task completes, and prints the newly generated password.

Prerequisites

• The [e-mail] password must be known and functional. If it is also unknown, reset it first using the procedure described in Resetting the [e-mail] password for VMware Cloud Foundation Services Runtime, then return here to reset admin@System.
• curl and jq must be available on the machine where the script is run (any Linux/macOS host with network access to the VCFA platform FQDN, or the VCFA appliance itself).

Procedure

1. Take a backup of VCFA via Fleet LCM.
2. Obtain the script and place it on a host that can reach the VCFA platform API:

   # Copy the script to the target host, e.g.:
   scp reset_system_admin_password.sh vmware-system-user@<VCFA-Platform-FQDN>:~
   ssh vmware-system-user@<VCFA-Platform-FQDN>
   sudo -i

3. Set the required environment variables and run the script:

   export PLATFORM_FQDN=<VCFA-Platform-FQDN>
   export VSP_ADMIN_PASSWORD=<vsp-admin-password>
   bash reset_system_admin_password.sh

4. On success, the script prints the newly generated password:

   Fetching auth token...
   Token acquired.
   Requesting password reset for System organization admin...
   Task ID: <task-id>
   Polling task status...
   Status: RUNNING              elapsed: 5s
   ...
   Password reset succeeded.
   New password: <new-password>

5. Log into https://<VCFA-Platform-FQDN>/provider using admin@System and the printed new password.
6. Immediately change the password to a known, secure value via Administration > Users.

Additional Information

Script reference

#!/usr/bin/env bash
# Required environment variables:
#   PLATFORM_FQDN        - FQDN of the VCFA platform (e.g. vcfa.example.com)
#   VSP_ADMIN_PASSWORD   - Password for the [e-mail] VSP platform account

The script performs the following steps automatically:

1. Authenticates to https://${PLATFORM_FQDN}/api/v1/identity/token as [e-mail].
2. Calls POST https://${PLATFORM_FQDN}/api/v1/components/vcfa/tenant-manager?action=resetpassword with {"username": "admin"}.
3. Polls GET https://${PLATFORM_FQDN}/api/v1/tasks/<task-id> every 5 seconds (timeout: 300 seconds).
4. Prints the new password upon SUCCEEDED status, or exits with an error on failure.

Troubleshooting

Symptom	Likely cause
Failed to obtain access token	VSP_ADMIN_PASSWORD is wrong or the [e-mail] account is also locked. See the prerequisite above for the [e-mail] reset procedure.
No task ID returned	The API call to trigger the reset failed. Check that PLATFORM_FQDN is reachable and that the VCFA Tenant Manager component is healthy.
Task failed	Inspect the task messages printed by the script and check Tenant Manager pod logs via kubectl -n prelude logs -l app=tenant-manager.
Timed out after 300 s	The reset task is still running. Check task status manually: curl -ks https://${PLATFORM_FQDN}/api/v1/tasks/<task-id> -H "Authorization: Bearer <token>"