Lost admin password
Nobody knows the Dolibarr administrator password any more. The “Password forgotten?” link, another administrator, or the database, without breaking the hashing.
The contractor who installed Dolibarr has left, or the only administrator no longer remembers the password. There are three ways out. Try them in this order.
What follows applies to Dolibarr’s standard authentication, the
$dolibarr_main_authentication='dolibarr' line in conf.php. If your users log in through LDAP or
another system, the password is changed in that system.
1. The “Password forgotten?” link
It is on the login page, unless an administrator has hidden it (constant
MAIN_SECURITY_DISABLEFORGETPASSLINK). Dolibarr then sends a reset link by email.
Two conditions for this to work: the user must have an email address on their user card, and Dolibarr’s email sending must work. But the administrator account created by the installer has no email address: on the test instance, the field was empty. For that account, the link often leads nowhere.
2. Another administrator
If another administrator account still works: Users & Groups, card of the user concerned, Modify, Password field, Save. This is the cleanest method.
3. Through the database
When nobody can log in any more, the database remains. You need access to MySQL or MariaDB: phpMyAdmin at most hosts, or the command line.
Tables have a prefix, llx_ by default. Yours is on the $dolibarr_main_db_prefix line of
conf.php. To find the administrators’ logins:
SELECT login, email FROM llx_user WHERE admin = 1;Then set a temporary password:
UPDATE llx_user SET pass = 'Temporary-to-change', pass_crypted = NULL WHERE login = 'admin';Log in with that password, then change it immediately from the user card (Modify, Password,
Save). Dolibarr then stores the new password hashed and erases the clear-text version: on the test
instance, the pass column went back to empty and the temporary password no longer let anyone log
in.
Why not a hash directly in SQL
Many tutorials give a query with MD5('…'). Whether it works depends on your instance’s settings:
the way Dolibarr hashes passwords depends on the MAIN_SECURITY_HASH_ALGO constant, and sometimes
on a salt. A hash computed by hand can therefore be refused with no explanation.
The temporary clear-text password goes through a path the login code keeps for very old installations, present in versions 17, 19, 22 and 24. It works whatever those settings are. It just must not stay in clear text: hence the immediate change.
In Docker
With the database in a MariaDB container, the console opens like this (replace the container, user and database names with yours):
docker exec -it <db_container> mariadb -u dolibarr -p dolibarr