ECS: How to Change or Unlock Management and Monitor Users with the REST API

Sometimes users forget their password and can no longer log in to the ECS with their credentials.

To change the password with the REST API:

1. Obtain a list of the current users. The following command lists all users except emcmonitor and emcservice:

Command:

# svc_rest_cmd -u root -p ChangeMe /vdc/users/

Example:

admin@ecsnode1:~> svc_rest_cmd -u root -p ChangeMe /vdc/users/
svc_rest_cmd 1.0.10

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<mgmt_user_infos>
  <mgmt_user_info>
    <is_external_group>false</is_external_group>
    <isSystemAdmin>false</isSystemAdmin>
    <isSystemMonitor>false</isSystemMonitor>
    <userId>emcsecurity</userId>
  </mgmt_user_info>
  <mgmt_user_info>
    <is_external_group>false</is_external_group>
    <isSystemAdmin>true</isSystemAdmin>
    <isSystemMonitor>true</isSystemMonitor>
    <userId>lex</userId>
  </mgmt_user_info>
  <mgmt_user_info>
    <is_external_group>false</is_external_group>
    <isSystemAdmin>true</isSystemAdmin>
    <isSystemMonitor>true</isSystemMonitor>
    <userId>root</userId>
  </mgmt_user_info>

To query a specific user, including special accounts like emcmonitor and emcservice, use the following syntax:

Command:

# svc_rest_cmd -u root -p ChangeMe /vdc/users/<username>

Example:

admin@ecsnode1:~> svc_rest_cmd -u root -p ChangeMe /vdc/users/emcmonitor
svc_rest_cmd 1.0.10

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<mgmt_user_info>
  <is_external_group>false</is_external_group>
  <is_locked>false</is_locked>
  <isSecurityAdmin>false</isSecurityAdmin>
  <isSystemAdmin>false</isSystemAdmin>
  <isSystemMonitor>true</isSystemMonitor>
  <userId>emcmonitor</userId>
</mgmt_user_info>

2. Create a file with the password SystemAdmin and SystemMonitor access that the user should have. In this example, the user that must be reset was emcmonitor:

# vi /file/path

• Press the Insert Key.
• Paste the following into the CLI session: (Right click does the same as the windows Ctrl+v hot keys)

<mgmt_user_info_update>
   <password>ChangeMe</password>
   <isSystemAdmin>false</isSystemAdmin>
   <isSystemMonitor>true</isSystemMonitor>
</mgmt_user_info_update>

• Press Esc
• Type :wq!

admin@ecsnode1:~> vi /tmp/emcmonitor
<mgmt_user_info_update>
   <password>ChangeMe</password>
   <isSystemAdmin>false</isSystemAdmin>
   <isSystemMonitor>true</isSystemMonitor>
</mgmt_user_info_update>

3. Confirm the file contents:

# cat /file/path

admin@ecsnode1:~> cat /tmp/emcmonitor
<mgmt_user_info_update>
   <password>ChangeMe</password>
   <isSystemAdmin>false</isSystemAdmin>
   <isSystemMonitor>true</isSystemMonitor>
</mgmt_user_info_update>
NOTE:  Make sure that the SystemAdmin and SystemMonitor is correct, this will change the user abilities.  Match this with the output from step 1.

4. Reset the password with the below svc_rest_cmd:

Command:

# svc_rest_cmd PUT -u root -p ChangeMe -xml -file <file_name> /vdc/users/<user_to_change>

#svc_rest_cmd PUT -u root -p ChangeMe -xml -file /tmp/emcmonitor /vdc/users/emcmonitor
svc_rest_cmd 1.0.10

Now the user can log in with the password defined in the file made in step 2.

For a locked account, to unlock and change the password on an account with the REST API:
This method works when the VDC has Password Rules enabled and the user account attribute when shows is_locked as true:

admin@ecsnode1:~> svc_rest_cmd -u root -p ChangeMe /vdc/users/emcservice
svc_rest_cmd 1.0.10

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<mgmt_user_info>
  <is_external_group>false</is_external_group>
  <is_locked>true</is_locked>
  <isSecurityAdmin>false</isSecurityAdmin>
  <isSystemAdmin>false</isSystemAdmin>
  <isSystemMonitor>true</isSystemMonitor>
  <userId>emcservice</userId>
</mgmt_user_info>

1. Create a file with the following contents. If Password Rules are enabled, the password being set should meet any criteria set by Password Rules.

<mgmt_user_info_unlock>
   <password>ChangeMe</password>
</mgmt_user_info_unlock>

2. Unlock and reset the password with the below svc_rest_cmd:

Command:

# svc_rest_cmd PUT -u root -p ChangeMe -xml -file <file_name> /vdc/users/<user_to_change>/unlock

Example:

 #svc_rest_cmd PUT -u root -p ChangeMe -xml -file /tmp/emcservice /vdc/users/emcservice/unlock
svc_rest_cmd 1.0.10

No output is expected. Check the user account and validate that the is_locked value is set to false:

admin@ecsnode1:~> svc_rest_cmd -u root -p ChangeMe /vdc/users/emcservice
svc_rest_cmd 1.0.10

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<mgmt_user_info>
  <is_external_group>false</is_external_group>
  <is_locked>false</is_locked>
  <isSecurityAdmin>false</isSecurityAdmin>
  <isSystemAdmin>false</isSystemAdmin>
  <isSystemMonitor>true</isSystemMonitor>
  <userId>emcservice</userId>
</mgmt_user_info>