Locked Out of System Administrator Account

Applies to: Mattermost Server v9.0 and later
Symptoms: System Administrator locked out during SAML configuration or unable to access system due to authentication changes

Problem

A System Administrator may become locked out of the Mattermost system in the following scenarios:

  • During SAML configuration process when authentication method changes
  • When email sign-in is disabled before switching to a new sign-in method
  • After misconfiguring authentication settings

When this occurs, the administrator cannot access the System Console to fix the configuration or manage the system.

Solution

Use mmctl in local mode to either promote an existing user account or create a new account and promote it to System Admin. Local mode bypasses authentication requirements by connecting directly to the Mattermost server using the configuration file.

Info: The steps vary depending on your deployment method. Choose the appropriate section below based on how Mattermost is deployed.
Note: To use local mode in mmctl you need to enable the respective config setting. Changing this setting requires a server restart.

 

Option 1: Promote an Existing User Account

If you have an existing user account that you can access, you can promote it to System Admin.

Bare Metal / Tarball Installation

1. SSH into your Mattermost server.

2. Navigate to the Mattermost installation directory:

cd /opt/mattermost

3. Promote the user to System Admin:

sudo -u mattermost bin/mmctl --local roles system_admin username

Replace username with the username of the account you want to promote.

Docker Installation

Promote the user to System Admin directly using docker exec:

docker exec mattermost-container-name mmctl --local roles system_admin username

Replace mattermost-container-name with your actual container name and username with the username to promote.

Kubernetes Installation

1. Get the Mattermost pod name:

kubectl get pods -n mattermost

2. Execute the command in the pod:

kubectl exec -it mattermost-pod-name -n mattermost -- mmctl --local roles system_admin username

Replace mattermost-pod-name with your actual pod name and username with the username to promote.

Option 2: Create a New User Account with System Admin Role

If you don't have access to any existing accounts, you can create a new user account with System Admin privileges in a single command.

Bare Metal / Tarball Installation

1. SSH into your Mattermost server.

2. Navigate to the Mattermost installation directory:

cd /opt/mattermost

3. Create a new user account with System Admin role:

sudo -u mattermost bin/mmctl --local user create --email admin@example.com --username newadmin --password Password123! --system-admin

Docker Installation

Create a new user account with System Admin role:

docker exec mattermost-container-name mmctl --local user create --email admin@example.com --username newadmin --password Password123! --system-admin

Kubernetes Installation

1. Get the Mattermost pod name:

kubectl get pods -n mattermost

2. Create a new user account with System Admin role:

kubectl exec -it mattermost-pod-name -n mattermost -- mmctl --local user create --email admin@example.com --username newadmin --password Password123! --system-admin
Note: Replace the email, username, and password with your desired values. Make sure to use a strong password that meets your organization's security requirements.

 

Verify the Role Assignment

After promoting the user, verify the role assignment was successful:

Bare Metal / Tarball:

sudo -u mattermost bin/mmctl --local user get username

Docker:

docker exec mattermost-container-name mmctl --local user get username

Kubernetes:

kubectl exec -it mattermost-pod-name -n mattermost -- mmctl --local user get username

The output should show that the user has the system_admin role assigned.

Important: After regaining access, review your SAML or authentication configuration to prevent future lockouts. Always maintain at least one working System Admin account with email authentication enabled. For security, change the password of any newly created admin accounts immediately after logging in.

Additional Resources

For more information, see:

Was this article helpful?
0 out of 0 found this helpful

Comments

0 comments

Article is closed for comments.