PowerScale OneFS | Unable to provision SupportAssist due to ESE user being Unmodifiable User

• This KB only focuses on the symptoms and error caused by ESE user being added to the Unmodifiable User list.
• Affected versions so far: 9.7.1.x, 9.10.x
• Unable to provision SupportAssist or connectivity
• Provision task gets stuck in the INCOMING state:

  Provision Status:
  
     Current State: INCOMING
         Sub-state: INCOMING
   Success or Fail: -
  Percent Complete: -
             Error: -

• The following errors "Error in resetting ESE password" are logged in isi_crispies_d.log:

isi_crispies_d.log
ISILON-10: 2025-09-23T14:42:12.764536+02:00 <3.3> ISILON-10(id46) isi_crispies_d[60720]: MainThread(crispies_helper.py:1354) ERROR: Error in resetting ESE password
ISILON-10: 2025-09-23T14:42:12.764623+02:00 <3.3> ISILON-10(id46) isi_crispies_d[60720]: MainThread(isi_crispies_d:393) ERROR: Exception(main):
ISILON-10: 2025-09-23T14:42:48.041428+02:00 <3.6> ISILON-10(id46) isi_crispies_d[60720]: MainThread(isi_crispies_d:323) INFO: Main thread received startup request, Starting ESE...
ISILON-10: 2025-09-23T14:42:48.287931+02:00 <3.3> ISILON-10(id46) isi_crispies_d[60720]: MainThread(crispies_helper.py:1354) ERROR: Error in resetting ESE password
ISILON-10: 2025-09-23T14:42:48.288006+02:00 <3.3> ISILON-10(id46) isi_crispies_d[60720]: MainThread(isi_crispies_d:393) ERROR: Exception(main):
isi_papi_d.log

• The following evidence is found in isi_papi_d.log:

ISILON-5:  2025-09-23T14:43:41.660448+02:00 <3.6> ISILON-5(id41) isi_papi_d[51994]: base: http://; uri: /16/auth/users/ese/reset-password; method: POST; args: {} ; len: 2; remote_addr: ; user: "token": {"UID":0, "GID":0, "zone id": 1 }
ISILON-5:  2025-09-23T14:43:41.715129+02:00 <3.6> ISILON-5(id41) isi_papi_d[51994]: STACK Password reset failed     from --- (---:0):      isi_exception::isi_exception(int, char const*, __va_list_tag*) (OFFSET:134)     api_exception::api_exception(api_error_code, char const*, ...) (OFFSET:146)     auth_user_reset_pwd_handler::http_post(request const&, response&) (OFFSET:1069)     uri_handler::execute_http_method_internal(request&, response&) (OFFSET:188)     uri_handler::execute_http_method(request&, response&, bool, bool) (OFFSET:1163)     uri_manager::execute_request(request&, response&, bool, bool, bool, bool, bool) (OFFSET:1562)     std::__1::basic_filebuf<char, std::__1::char_traits<char> >::basic_filebuf(void) (OFFSET:7740)     std::__1::basic_filebuf<char, std::__1::char_traits<char> >::basic_filebuf(void) (OFFSET:10660)     typeinfo name for api_exception (OFFSET:48093)     typeinfo name for api_exception (OFFSET:45083)     ADDRESS (UNKNOWN:378798080)

• This issue is a result of applying workaround steps from DSA-2025-119, "workaround 1" under CVE-2025-27690:

1. Verify that your symptoms match this KB. 

2. Check current Unmodifiable Users list:

# isi auth file view System | grep "Unmodifiable Users.*ese";
Unmodifiable Users: _dhcp, _lldpd, _pflogd, _ypldap, auditdistd, bin, bind, daemon, ese, group, hast, kmem, mailnull, man, news, ntpd, null, operator, pop, proxy, smmsp, sshd, tty, unbound, uucp

3. Remove ESE user from Unmodifiable Users list.

# isi auth file modify System --remove-unmodifiable-users=ese;

4. Verify that the changes have been applied:

# isi auth file view System | grep "Unmodifiable Users";

5. Allow SupportAssist or connectivity provision task to complete. 

6. After SupportAssist or Connectivity provision is successful and complete, can add ESE user back:

# isi auth file modify System --add-unmodifiable-users=ese;

7. Verify it was added:

# isi auth file view System | grep "Unmodifiable Users.*ese";