Skip to content

feat(idm): add --service-user flag to resetpassword command #12118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mmattel merged 4 commits into from
Apr 17, 2026
+29 −3
Merged

feat(idm): add --service-user flag to resetpassword command #12118

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
115f3db
feat(idm): add --service-user flag to resetpassword command
paul43210 Mar 14, 2026
468f2ac
docs: update changelog with PR number
paul43210 Mar 14, 2026
2e45f5a
refactor(idm): use --user-type flag instead of --service-user bool
paul43210 Apr 15, 2026
434210c
Merge branch 'master' into fix/idm-resetpw-service-users
mmattel Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions changelog/unreleased/fix-idm-resetpw-service-users.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
Enhancement: Allow resetting IDM service user passwords

The `ocis idm resetpassword` command now supports a `--service-user`
flag to target service accounts (libregraph, idp, reva) which live in
`ou=sysusers` instead of `ou=users`. Previously, the DN was hardcoded
to `ou=users`, making it impossible to reset service user passwords
via the CLI.

https://github.com/owncloud/ocis/pull/12118
https://github.com/owncloud/ocis/issues/12106
14 changes: 11 additions & 3 deletions services/idm/pkg/command/resetpw.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,10 @@ func ResetPassword(cfg *config.Config) *cli.Command {
Usage: "User name",
Value: "admin",
},
&cli.BoolFlag{
Comment thread
mmattel marked this conversation as resolved.
Outdated
Name: "service-user",
Usage: "Target a service user (ou=sysusers) instead of a regular user (ou=users)",
},
},
Before: func(_ *cli.Context) error {
return configlog.ReturnFatal(parser.ParseConfig(cfg))
Expand All @@ -43,12 +47,12 @@ func ResetPassword(cfg *config.Config) *cli.Command {
ctx, cancel := context.WithCancel(c.Context)

defer cancel()
return resetPassword(ctx, logger, cfg, c.String("user-name"))
return resetPassword(ctx, logger, cfg, c.String("user-name"), c.Bool("service-user"))
},
}
}

func resetPassword(_ context.Context, logger log.Logger, cfg *config.Config, userName string) error {
func resetPassword(_ context.Context, logger log.Logger, cfg *config.Config, userName string, serviceUser bool) error {
servercfg := server.Config{
Logger: log.LogrusWrap(logger.Logger),
LDAPHandler: "boltdb",
Expand All @@ -57,7 +61,11 @@ func resetPassword(_ context.Context, logger log.Logger, cfg *config.Config, use
BoltDBFile: cfg.IDM.DatabasePath,
}

userDN := fmt.Sprintf("uid=%s,ou=users,%s", userName, servercfg.LDAPBaseDN)
ou := "users"
if serviceUser {
ou = "sysusers"
}
userDN := fmt.Sprintf("uid=%s,ou=%s,%s", userName, ou, servercfg.LDAPBaseDN)
fmt.Printf("Resetting password for user '%s'.\n", userDN)
if _, err := os.Stat(servercfg.BoltDBFile); errors.Is(err, os.ErrNotExist) {
fmt.Fprintf(os.Stderr, "IDM database does not exist.\n")
Expand Down