Cannot change the password of the default admin account?

[shadowrunner]

Good day,

We use active directory for JIRA and Confluence

However, for Confluence, the local directory is enabled and it's not managed by JIRA

When trying to change anything to that admin account, even on the account itself, it throws us these errors:

Cause

com.atlassian.user.EntityException: com.atlassian.crowd.exception.OperationNotPermittedException: com.atlassian.crowd.exception.ApplicationPermissionException: Not allowed to update user 'admin' in directory 'Confluence Internal Directory'.
    at com.atlassian.crowd.embedded.atlassianuser.EmbeddedCrowdUserManager.alterPassword(EmbeddedCrowdUserManager.java:192)

caused by: com.atlassian.crowd.exception.OperationNotPermittedException: com.atlassian.crowd.exception.ApplicationPermissionException: Not allowed to update user 'admin' in directory 'Confluence Internal Directory'.
    at com.atlassian.crowd.embedded.core.CrowdServiceImpl.updateUserCredential(CrowdServiceImpl.java:312)

caused by: com.atlassian.crowd.exception.ApplicationPermissionException: Not allowed to update user 'admin' in directory 'Confluence Internal Directory'.
    at
com.atlassian.crowd.manager.application.ApplicationServiceGeneric.updateUserCredential(ApplicationServiceGeneric.java:636)

Is there anything we can do so that we can change the password of the admin account?

Thanks

[miikhy · Accepted solution]

Hi Diego, Alex,

I'm contracting for Alex and just fixed it yesterday.

@Diego for your reference the issue was that the cwd_app_directory_mapping had 2 entries for Confluence Internal Directory and only one had permission in cwd_app_dir_operation. Removing the duplicate in both table and keeping only the original Internal Directory + restarting Confluence made it work!

Cheers

[shadowrunner]

Thanks a lot!

[Diego]

Great to hear that @miikhy ! Also, thank you very much for sharing the solution here with the Community.

[Diego]

Hello there Alex!
As I understand, Confluence has its own internal user directory and you are currently unable to update the user password for the user admin. Is that correct?

This behaviour can be caused due to missing "allowed operations". Allowed operations tell us which operations can be executed within said directory. This can be caused by manually dealing with the database, for example.

You can check more about this here:

• Unable to set password for internal directory user

Here is the query that helps us to identify any missing operations:

SELECT * FROM cwd_directory_operation WHERE directory_id=<internal_directory_id>;

Be sure to replace <internal_directory_id>. If your directory ID was 1337, it would look like this:

SELECT * FROM cwd_directory_operation WHERE directory_id=1337;

To get the Directory ID, you can use the following query:

SELECT *
FROM cwd_directory

For the directory to work as intended, some operation permissions are necessary. The operations we need are these:

CREATE_ROLE, CREATE_USER, DELETE_ROLE, UPDATE_USER, UPDATE_USER_ATTRIBUTE, DELETE_GROUP, CREATE_GROUP, UPDATE_ROLE_ATTRIBUTE, DELETE_USER, UPDATE_GROUP_ATTRIBUTE, UPDATE_GROUP, UPDATE_ROLE

Once we find the missing operation in your directory, we will need to manually insert it there.

Please, remember to backup your database before applying any kind of change to it.

Let us hear from you Alex! Looking forward to your reply.

[shadowrunner]

I'll check it out and keep you updated, thanks

[shadowrunner]

Hi, we just tired it:

mysql> SELECT * FROM cwd_directory_operation WHERE directory_id=_________;
+--------------+------------------------+
| directory_id | operation_type |
+--------------+------------------------+
| _________ | CREATE_GROUP |
| _________ | CREATE_ROLE |
| _________ | CREATE_USER |
| _________ | DELETE_GROUP |
| _________ | DELETE_ROLE |
| _________ | DELETE_USER |
| _________ | UPDATE_GROUP |
| _________ | UPDATE_GROUP_ATTRIBUTE |
| _________ | UPDATE_ROLE |
| _________ | UPDATE_ROLE_ATTRIBUTE |
| _________ | UPDATE_USER |
| _________ | UPDATE_USER_ATTRIBUTE |
+--------------+------------------------+
12 rows in set (0.00 sec)

(I've hidden the directory ID)

Everything seems to be in order