Reset a User's Password

A user has lost access to their account. Before acting, identify which of the three passwords is involved (they are independent), and the alternative chosen when the account was created.

Three distinct passwords

Password	Used for	Where to reset it
Identity (Kanidm)	Signing in to services (SSO)	Kanidm link
Vault (Vaultwarden)	Unlocking the password manager	Emergency access
Session (NixOS)	Logging in on a workstation	`just passwd`

Identity (Kanidm)

Create a reset link :

just invite <login>            # non-technician: link valid for 1 hour
just invite <login> advanced   # technician: link valid for 24 hours

Depending on the user :
- Non-technician: open the link yourself, redefine the password and TOTP, update the item in their collection.
- Technician: send them the welcome sheet (link and QR code).

Vault

The master password encrypts the vault: no server knows it.

Situation	Remedy
Forgotten password, emergency access enabled	Takeover by the trusted contact
Forgotten password, otherwise	Delete User in `/admin`, then a new invitation
Lost 2FA	Remove all 2FA in `/admin`

The /admin panel only responds from the LAN and the tailnet.

Session password

The login password on a machine is managed in the secrets, not in Kanidm. just invite <login> offers to redefine it, or directly just passwd <login>.

The user’s GNOME keyring then starts empty again at their next session.