Introduction

There might be situations when users lock the door behind them and throw away the key to access JOC Cockpit:

• If JS7 - Identity Services are used that are based on external access to an Identity Provider, such as an JS7 - LDAP Identity Service that is not accessible.
• If a misconfiguration occurs that prevents an Identity Service from authenticating and/or authorizing a user account, for example due to missing permissions.

In such situations a key service is required to open the door.

Rescue Script

The Rescue Script is available to administrators with access to the server for which JOC Cockpit is operated.

Identify the JOC Cockpit Installation Directory

JOC Cockpit by default is installed

• for Unix to the
  • installation directory: /opt/sos-berlin.com/js7/joc
• for Windows to the
  • installation directory:  Program Files\sos-berlin.com\js7\joc

However, the installation directory can be freely chosen during setup.

If in doubt try to identify where JOC Cockpit is located from running processes:

• For Unix execute the command
  • ps -ef | grep js7 or ps -ef | grep joc
  • This should return processes related to JS7. The process in question includes the characters "joc" and should indicate its installation directory.
• For Windows use the Task Manager to identity a process with the name 
  • js7_joc.exe
  • Adding the "command line" column to display of processes with the Task Manager should present the installation directory.

Run the Rescue Script to create the JOC-RESCUE Identity Service

The JOC Cockpit installation directory includes a sub-folder install that holds the Rescue Script:

• joc_install_tables.sh for Unix,
• joc_install_tables.cmd for Windows.

Run the rescue script like this:

./joc_install_tables.sh -rescue

Notes:

• Consider that the Rescue Script requires the java executable to be included in the directories specified by your PATH environment variable.
• If in doubt then identify the location of your Java JDK or JRE and execute
  • PATH=$PATH:/usr/lib/java/jdk/bin
  • provided that your java executable is located in /usr/lib/java/jdk/bin

joc_install_tables.cmd -rescue

Notes:

• Consider that the Rescue Script requires the java.exe executable to be included in the directories specified by your PATH environment variable.
• If in doubt then identify the location of your Java JDK or JRE and execute
  • set PATH=%PATH%;C:\Program Files\Java\jdk\bin
  • provided that your java.exe executable is located in C:\Program Files\Java\jdk\bin

The Rescue Script will perform the following actions:

• The Rescue Script acts on the JS7 - Database and works independently from the fact that JOC Cockpit is started or not.
• The Rescue Script
  • disables any existing Identity Services,
  • adds an Identity Service of type JOC with the name JOC-RESCUE,
    • adds an administrative role for full access to JOC Cockpit with the name all to the Identity Service,
    • adds a user account with the name root and the password root to the Identity Service.

With the Rescue Script being executed you can login to JOC Cockpit with credentials specifying

• user: root
• password root

Repair Identity Services

After login you should find

• a new Identity Service JOC-RESCUE being active:
  • the Identity Service includes a single user account root with the all role that is granted full permissions
• any previously configured Identity Services being disabled.

This is the perfect point in time to reconfigure the offending Identity Service(s) that prevented users from login.

• Consider to enable offending Identity Service(s) having reworked the respective configuration.
• It is recommended to make Identity Services optional and not to use required Identity Services.

Then try to login to JOC Cockpit by using accounts specified from the repaired Identity Service(s).

Remove JOC-RESCUE Identity Service

When things are back to normal then delete the JOC-RESCUE Identity Service.

• Removing the Identity Service includes
  • to remove the user account root from the Identity Service (other Identity Services still can use a user account with this name that is local to the Identity Service),
  • to remove the all role of the Identity Service,
  • to remove the Identity Service configuration.