oak-run Groovy script to reset the Adobe AEM "admin" user password

adminUtils.groovy

import org.apache.jackrabbit.oak.spi.commit.CommitInfo
import org.apache.jackrabbit.oak.spi.commit.EmptyHook
import org.apache.jackrabbit.oak.spi.state.NodeStore
import org.apache.jackrabbit.oak.commons.PathUtils
import com.google.common.collect.Lists
import java.util.List


public class AdminUtils {
    public resetAdminPassword(def session) {
        String path = "/home/users";
        List<String> elements = Lists.newArrayList();
        PathUtils.elements(path).each{String element ->
            if (PathUtils.denotesParent(element)) {
                if (!elements.isEmpty()) {
                    elements.remove(elements.size() - 1);
                }
            } else if (!PathUtils.denotesCurrent(element)) {
                elements.add(element);
            }
        }
        
        NodeStore nstore = session.store
        def rs = nstore.root
        def ns = rs
        def rnb = rs.builder()
        elements.each {
          if(it.size() > 0) {
            ns = ns.getChildNode(it)
          }
        }
        def isAdminFound = false;
        def entryIter = ns.getChildNodeEntries()
        entryIter.each { 
            setAdminPasswordRecurse(session, nstore, path + "/" + it.getName(), ns, it)
        }
        
        session.refresh();
    }

    private setAdminPasswordRecurse(def session, def nodeStore, def curPath, def parentState, def childEntry) {
        def ns = childEntry.getNodeState()
        def entryIter = ns.getChildNodeEntries()
        entryIter.each {
            def prop = it.getNodeState().getProperty("rep:principalName")
            if(prop != null && "admin".equals(prop.getValue(prop.getType()))) {
                println("Found admin user node: " + (curPath + "/" + it.getName()))
                def passProp = it.getNodeState().getProperty("rep:password")
                println("Password hash before: " + passProp.getValue(prop.getType()))
                
                String newHash = "{SHA-256}a9d4b340cb43807b-1000-33b8875ff3f9619e6ae984add262fb6b6f043e8ff9b065f4fb0863021aada275"
                def rnb = nodeStore.root.builder()
                def nb = getNodeBuilderForPath(rnb, curPath)
                def cnb = nb.getChildNode(it.getName())
                cnb.setProperty("rep:password", newHash)
                nodeStore.merge(rnb, EmptyHook.INSTANCE, CommitInfo.EMPTY);
                println("Password set successfully: " + newHash)
                return true
            }
            setAdminPasswordRecurse(session, nodeStore, curPath + "/" + it.getName(), parentState, it)
            return false
        }
    }
    
    private getNodeBuilderForPath(def rootNodeBuilder, def argpath) {
        def nb = rootNodeBuilder
        String path;
        if (PathUtils.isAbsolute(argpath)) {
            path = argpath;
        } else {
            path = PathUtils.concat(session.getWorkingPath(), argpath);
        }
        List<String> elements = Lists.newArrayList();
        PathUtils.elements(path).each{String element ->
            if (PathUtils.denotesParent(element)) {
                if (!elements.isEmpty()) {
                    elements.remove(elements.size() - 1);
                }
            } else if (!PathUtils.denotesCurrent(element)) {
                elements.add(element);
            }
        }

        elements.each {
          if(it.size() > 0) {
            nb = nb.getChildNode(it)
          }
        }
        return nb
    }
}

INSTRUCTIONS.md

To run this script:

1. Download the oak-run version matching the version of Oak installed in AEM: http://repo1.maven.org/maven2/org/apache/jackrabbit/oak-run
2. Download the attached adminUtils.groovy script
3. Upload the adminUtils.groovy script and the oak-run jar to your AEM server
4. Run the command to start the oak-run console. For example:

   java -Xmx2048m -jar /tmp/oak-run-1.6.1.jar console /app/aem/aem63/crx-quickstart/repository/segmentstore --read-write
   

5. Once the oak-run console is open then load the groovy script using this command:

   :load /tmp/adminUtils.groovy
   

6. Run this command to reset the "admin" user's password back to "admin"

   new AdminUtils().resetAdminPassword(session)
   

   Example output:

   Found admin user node: /home/users/a/aQUb-B8ZQDUlRfxPeFIu
   Password hash before: {SHA-256}a9d4b340cb43807b-1000-33b8875ff3f9619e6ae984add262fb6b6f043e8ff9b065f4fb0863021aada275
   Password set successfully: {SHA-256}a9d4b340cb43807b-1000-33b8875ff3f9619e6ae984add262fb6b6f043e8ff9b065f4fb0863021aada275
   

Change line 34 from "entryIter.find {" to "entryIter.each {" if it cannot find the admin user under /home/users.