Resetting the PAM super user password

Document ID : KB000096844
Last Modified Date : 31/05/2018
Show Technical Document Details
Introduction:
PAM comes with two build-in administrative accounts, config and super. Online documentation shows how to change the password while logged on, see e.g. https://docops.ca.com/ca-privileged-access-manager/3-2/EN/implementing/configure-your-server/configuration-utility/change-login-for-config-or-super-user. PAM also provides a Reset Password option on the VM console for virtual appliances, or the front panel for hardware appliances. This resets the config user password to "config". There is no documented option to reset the super user password if it got lost for whatever reason.
Question:
Is there any way for a customer to reset the super user password?
Environment:
This applies to any PAM release as of May 2018 with 3.2 being the latest release. It may change in future releases.
Answer:
There is no option to reset the super user password. Neither the config user nor any other global administrator can do it, and there is no option in the console menu as of PAM 3.2. The password is stored in the database. The only potential option would be to restore a database backup from a time where the super user had a known password. This could be accomplished by logging in with another global administrator account, or with the config account. But it is not practical if the password had been updated a long time ago, which most likely is true in cases where it got lost.
If a database backup is not an option, you will have to open a case with PAM support to work with you on resolution of the problem.
Additional Information:
Note that the "Change Password" page for the config user, which logs on using URL https://<PAMserver>/config/, includes a section "Change Administrator Login Name". This can be used to change the account name of the super user. It does not allow you to change the super user password. In fact you have to provide the current super user password to be able to change the name.