JSS hidden account

[jeffrey_ngo]

Hello everyone!

New to the JAMF family. I integrated my JSS with AD and it was working great until I changed my AD password, we now have an account setup for it that the password doesn't expire however, I cannot get into my JSS. I am wondering if there is some sort of local account, or root that might work? If not, lesson learned I suppose and I will tear down and rebuild. Just wondering because I did do some work that I'd rather not have to redo if possible.

Thanks!

[easyedc]

OOPS! I did this myself the first time I set up my JSS. I didn't find any solution at the time other than a quick teardown/rebuild. Luckily it was within the first week or so of using the JSS and I had not loaded anything up to it.

[mm2270]

So, I get that you joined your JSS with your AD and that now you can't log into the JSS with an AD account, but back when you were setting up your JSS for the first time, it would have prompted you to create a local JSS admin account, in other words, something that is local only to the JSS and not tied to a directory service, so with a non-expiring password.
Assuming you a) know what that account name/password is and b) you didn't actually disable it, this account would be the equivalent to a "root" account on the JSS. Its local, and should have all privileges and access. It would have been the very account you used initially to tie your JSS to AD I believe and possibly create your AD based accounts in the JSS.

Does that help at all? If you don't know the credentials to that account, you may be SOL though. I guess you can talk to JAMF and see if they know of some way back into it. perhaps via the MySQL command line.

[Lutz]

Everything @mm2270][/url said is totally accurate. If you have the MySQL credentials, you can find that original user account and the password used to log in. If you're not too familiar with MySQL I'd suggest using a GUI to interact with it, like Sequel Pro for OSX.

http://sequel pro.com

[jeffrey_ngo]

Sorry for the delay in response to everyone. I appreciate all the help. Jamfsupport actually reached out to me pretty much right away and helped me out with the issue.

"What we will need to do is truncate the table in the database that stores the usernames and passwords but before we do any of that, we'll want to make sure we have a backup of the database.
We can use the JSSDatabaseUtil.jar to create the backup of the database. To access the JSSDatabaseUtil.jar, navigate to /Library/JSS/bin/JSSDatabaseUtil.jar. Once you have opened the .jar file, click "Save Backup Now..." and save the backup to either the default location or your preferred location.

Once you have backed up the database, we'll need to truncate the users table in the database.

The goal of the work flow is to log into the MySQL command line, and run two commands: use jamfsoftware; truncate users; After running those two commands we can log out of MySQL, restart Tomcat and navigate to the JSS website. This will bring up the JSS setup assistant and allow us to enter new user information.

Here is a more detailed set of instructions.

- On the server, open a Terminal session and run this command to login into MySQL command line: mysql -u root -p

- Press enter if no password, or enter password for MySQL (in most cases there is no password set up) this should bring you to a MySQL prompt.

- At the mysql prompt type the following: use jamfsoftware;

- At the next mysql prompt type the following to truncate the users table in the database: truncate users;

- After running this command exit out of MySQL by typing: exit

- The next step is to restart Tomcat. We can do this with the JSSdatabaseUtil.jar.

- To restart Tomcat by using the JSSDatabaseUtil.jar file found on the server HD navigate to: /Library/JSS/bin/JSSDatabaseUtil.jar.

- Open the file and click Utilities in the top menu bar. The option to restart Tomcat will be there.

- After we have truncated users and restarted Tomcat we navigate to the JSS webapp address and it should display the Setup Assistant, and we'll be able to create our new account."

This worked perfectly for anyone that may encounter this problem.