Cannot change the password of the default admin account?
Asked by shadowrunner:

Good day,  

We use active directory for JIRA and Confluence  

However, for Confluence, the local directory is enabled and it's not managed by JIRA  

When trying to change anything to that admin account, even on the account itself, it throws us these errors:  

### Cause {#toc-hId-1084321359}

com.atlassian.user.EntityException: com.atlassian.crowd.exception.OperationNotPermittedException: com.atlassian.crowd.exception.ApplicationPermissionException: Not allowed to update user 'admin' in directory 'Confluence Internal Directory'.  
at com.atlassian.crowd.embedded.atlassianuser.EmbeddedCrowdUserManager.alterPassword(EmbeddedCrowdUserManager.java:192)

caused by: com.atlassian.crowd.exception.OperationNotPermittedException: com.atlassian.crowd.exception.ApplicationPermissionException: Not allowed to update user 'admin' in directory 'Confluence Internal Directory'.  
at com.atlassian.crowd.embedded.core.CrowdServiceImpl.updateUserCredential(CrowdServiceImpl.java:312)

caused by: com.atlassian.crowd.exception.ApplicationPermissionException: Not allowed to update user 'admin' in directory 'Confluence Internal Directory'.  
at  
com.atlassian.crowd.manager.application.ApplicationServiceGeneric.updateUserCredential(ApplicationServiceGeneric.java:636)  

Is there anything we can do so that we can change the password of the admin account?  

Thanks


Answers:
author: miikhy
body: Hi Diego, Alex,

I'm contracting for Alex and just fixed it yesterday.

[@Diego](/t5/user/viewprofilepage/user-id/1188952) for your reference the issue was that the cwd_app_directory_mapping had 2 entries for Confluence Internal Directory and only one had permission in cwd_app_dir_operation. Removing the duplicate in both table and keeping only the original Internal Directory + restarting Confluence made it work!

Cheers

comments: author: shadowrunner
body: Thanks a lot!


author: Diego
body: Great to hear that [@miikhy](/t5/user/viewprofilepage/user-id/449205) ! Also, thank you very much for sharing the solution here with the Community.


author: Diego
body: Hello there Alex!  
As I understand, Confluence has its own internal user directory and you are currently unable to update the user password for the user admin. Is that correct?

This behaviour can be caused due to missing "allowed operations". Allowed operations tell us which operations can be executed within said directory. This can be caused by manually dealing with the database, for example.

You can check more about this here:
> * ++***[Unable to set password for internal directory user](https://confluence.atlassian.com/confkb/unable-to-set-password-for-internal-directory-user-776664224.html)***++

Here is the query that helps us to identify any missing operations:
> *SELECT \* FROM cwd_directory_operation WHERE directory_id=\<internal_directory_id\>;*

Be sure to replace *\<internal_directory_id\>*. If your directory ID was 1337, it would look like this:
> *SELECT \* FROM cwd_directory_operation WHERE directory_id=1337;*

To get the Directory ID, you can use the following query:
> *SELECT \**   
> *FROM cwd_directory*

For the directory to work as intended, some operation permissions are necessary. The operations we need are these:
> *CREATE_ROLE, CREATE_USER, DELETE_ROLE, UPDATE_USER, UPDATE_USER_ATTRIBUTE, DELETE_GROUP, CREATE_GROUP, UPDATE_ROLE_ATTRIBUTE, DELETE_USER, UPDATE_GROUP_ATTRIBUTE, UPDATE_GROUP, UPDATE_ROLE*

Once we find the missing operation in your directory, we will need to manually insert it there.

Please, remember to **backup your database** before applying *any kind* of change to it.

<br />

Let us hear from you Alex! Looking forward to your reply.

comments: author: shadowrunner
body: I'll check it out and keep you updated, thanks


author: shadowrunner
body: Hi, we just tired it:  

mysql\> SELECT \* FROM cwd_directory_operation WHERE directory_id=_________;  
+--------------+------------------------+  
\| directory_id \| operation_type \|  
+--------------+------------------------+  
\| _________ \| CREATE_GROUP \|  
\| _________ \| CREATE_ROLE \|  
\| _________ \| CREATE_USER \|  
\| _________ \| DELETE_GROUP \|  
\| _________ \| DELETE_ROLE \|  
\| _________ \| DELETE_USER \|  
\| _________ \| UPDATE_GROUP \|  
\| _________ \| UPDATE_GROUP_ATTRIBUTE \|  
\| _________ \| UPDATE_ROLE \|  
\| _________ \| UPDATE_ROLE_ATTRIBUTE \|  
\| _________ \| UPDATE_USER \|  
\| _________ \| UPDATE_USER_ATTRIBUTE \|  
+--------------+------------------------+  
12 rows in set (0.00 sec)  

(I've hidden the directory ID)  

Everything seems to be in order


Tags: confluence-server

server