> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/troubleshooting/signing-in/resetting_passwords.md).

# Resetting passwords

Resetting every password in the deployment when the encryption key is gone, which is a recovery of last resort rather than an administrative action.

| Symptom                                                                                        | Likely cause                                                                  | Resolution                                           |
| ---------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ---------------------------------------------------- |
| No stored password can be decrypted after moving servers, or after recovering the secret store | The key that encrypted them is gone, so every stored credential is unreadable | Reset them all and let a new key be generated, below |

{% hint style="danger" %}
**This sets every user's password to one known value and discards every stored credential.** Managed system passwords, password history, challenge answers and synchronization source passwords all go with it. It is the recovery for a deployment whose encryption key is unrecoverable — **not** a way to reset one account, and **not** for production.

To reset a single user, use the Webconsole's own **Reset Password** screen.
{% endhint %}

## When this applies

The stored passwords are encrypted with a key held in the secret store. If that key is lost — a migration that did not bring the vault across, or a hard recovery from a vault failure — nothing holding an encrypted password can be read any more, and there is no way back to the original values.

Clearing them lets the ESB generate a new JKS key on the next start and begin again.

## Reset

{% stepper %}
{% step %}
**Stop OpenIAM.**

```bash
openiam-cli stop
```

{% endstep %}

{% step %}
**Clear the stored credentials.** Each statement drops a different store of encrypted material:

{% code overflow="wrap" %}

```sql
UPDATE LOGIN SET PASSWORD='passwd00';
DELETE FROM USER_KEY;
UPDATE MANAGED_SYS SET PSWD = NULL;
DELETE FROM PWD_HISTORY;
DELETE FROM USER_IDENTITY_ANS;
UPDATE SYNCH_CONFIG SET SRC_PASSWORD = NULL;
```

{% endcode %}

| Statement           | What it clears                                                      |
| ------------------- | ------------------------------------------------------------------- |
| `LOGIN`             | Every user's password, set to one shared value                      |
| `USER_KEY`          | The per-user keys                                                   |
| `MANAGED_SYS`       | The credential each managed system connects with                    |
| `PWD_HISTORY`       | Password history, which cannot be checked against unreadable values |
| `USER_IDENTITY_ANS` | Challenge question answers                                          |
| `SYNCH_CONFIG`      | Each synchronization's source password                              |
| {% endstep %}       |                                                                     |

{% step %}
**Commit**, and confirm the transaction went through.
{% endstep %}

{% step %}
**Start OpenIAM.** A new JKS key is generated and stored in the vault on this start.

```bash
openiam-cli start
```

{% endstep %}

{% step %}
**Put the credentials back.** Every managed system and every synchronization now has no password and will fail against its target until one is entered. Change the shared password immediately, and plan how users get their own back — they all hold the same one until they do.
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/troubleshooting/signing-in/resetting_passwords.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.