Skip to content
Darkone NixOS Framework

Reset a User's Password

A user has lost access to their account. Before taking action, identify which of the three passwords is involved: they are independent.

Three distinct passwords

Section titled “Three distinct passwords”
PasswordUsed forWhere to reset it
Identity (Kanidm)Logging into services (SSO)Kanidm token (below)
Vault (Vaultwarden)Unlocking the password managerVaultwarden invitation
Session (NixOS)Opening a session on a workstationjust passwd (below)

Identity and vault

Section titled “Identity and vault”

  1. Vault (Vaultwarden): resend an invitation from the admin interface; the user resets their master password via email.

  2. Identity (Kanidm): regenerate a reset token on the coordination server:

    Fenêtre de terminal
    just enter hcs
    kanidm person credential create-reset-token <login> --name idm_admin

  3. Send the link or QR code to the user, who then recreates their key and recovery password.

Session password

Section titled “Session password”

The login password on a workstation is managed in secrets, not in Kanidm:

  1. Set the password

    Fenêtre de terminal
    just passwd <login>

  2. Validate and deploy

    Fenêtre de terminal
    just commit "user(passwd): <login>"
    just apply @user-<login>