Reset the Odoo administrator password

reset_admin_password.py resets the password of user ID 2 in an existing Odoo 18 database through the ORM, preserving Odoo password hashing and installed password-policy validation. This is an operational recovery command for a system administrator with authorized database access.

Preview and execute

Run with the intended Odoo virtualenv as the service account, using the same configuration and checkout as the instance. No existing Odoo login or database-manager master password is required; PostgreSQL access comes from the Odoo configuration. The role needs access to the target database, not CREATEDB.

/srv/pmiverse/_pmisuite18/venv/bin/python \
  /srv/pmiverse/_pmiconfig/scripts/admin/reset_admin_password.py example_db \
  --dry-run

Remove --dry-run to perform the reset. --config selects the Odoo configuration and --odoo-root selects its checkout; both default to the _pmisuite18 instance. The preview does not connect to PostgreSQL, load Odoo, or access password files. Normal execution loads the installed addon registry but requests no database creation, module installation, or upgrade, and starts no HTTP server or cron. Use a functioning, compatible checkout and avoid concurrent module maintenance.

The command refuses missing/uninitialized databases, missing user ID 2, and an account without Settings access. An archived account requires explicit --activate; otherwise only its password changes. It does not create users, change login names, grant groups, reset MFA, disable external authentication, or change admin_passwd. MFA/SSO restrictions and custom authentication or password policies may require separate recovery. Password reset alone does not repair a damaged database or compromised installation.

Password handling

By default, a new random password is saved before the account is changed:

/srv/pmiverse/_pmiprivate/<database>_reset_pass_<UTC timestamp>

The timestamp includes microseconds. These files are separate from creation's <database>_init_pass file, so the original credentials are never overwritten. The directory must be owner-only and owned by the executing account; it is created with mode 0700 when absent. New password files use mode 0600 and exclusive creation. Symlinks and name collisions are refused. The account needs permission to create the directory, or an administrator must prepare it separately. Only the filename is printed, never the password.

Alternatively, --admin-password-file /secure/path/password reads an existing owner-only UTF-8 file owned by the executing account. It creates no generated password file. See shared password handling for the input-file requirements.

The password and optional activation are written in one ORM transaction and committed only after a successful write. A failure reports no confirmed success; connection loss during commit can leave the outcome uncertain. Generated files are retained even if the reset fails and might not match the account's password. Verify the account state before retrying. Keep or remove credential files under your normal secret-handling procedures after secure handoff.

Validation

The implementation guide documents shared helper ownership, the superuser/target-user distinction, credential persistence, transaction outcomes, and the focused validation command.

tests/test_reset_admin_password.py tests target selection, password persistence, activation, refusal, transaction failure, and dry-run behavior using synthetic Odoo objects. Shared helper tests remain in tests/test_create_database.py; CLI/help/completion checks are in tests/test_script_cli.py. Live database execution requires separate authorization.