Skip to main content
Version: Next

Recovering Cortex Admin Access

If no one currently has admin access to Cortex — for example, the Cortex Admin has left the company, or admin rights did not carry over when you switched to SAML or SSO for the first time — there are two ways to restore access. Use the one that fits your situation: the application approach is easier, and the database approach is a last resort for a database administrator.

Before you start​

  • You must be able to edit the Cortex appsettings.json file or have read/write access to the Cortex configuration database.
  • Cortex creates a user's account on their first login. Both options promote an existing account — you cannot promote a user who has never signed in, unless you manually create their account on the Admin > Users screen first.

Option 1: Change the authentication mode (easiest)​

  1. Back up appsettings.json before editing, so your SAML/SSO or other authentication configuration is not lost.
  2. Set Authentication > Type to "internal" and save. (On Linux, set the environment variable Authentication__Type instead.)
  3. Restart Cortex and sign in with the built-in administrator account: username cortex.admin, password cortex.admin. You will be required to change the password on first login. You may have already set a password to the internal cortex.admin account when you first installed Cortex.
  4. Grant admin access to the intended users (Admin → User Management, or Cortex System Manager).
  5. Restore the authentication settings you backed up in step 1.

If the built-in cortex.admin password is no longer known, you can instead use none authentication and set the OverrideUsername setting to the account you want to sign in as (for example, cortex.admin). In none mode, Cortex signs every visitor in as the account named in OverrideUsername, letting you restore access, after which you should reapply your real authentication settings.

warning

none mode signs every visitor in as the account named in OverrideUsername and is not intended for production. Use it only briefly to recover access, and restore your authentication settings immediately afterward.

Option 2: Update the Cortex database (last resort, for a DBA)​

If the authentication mode cannot be changed, an administrator with read/write access to the Cortex configuration database can promote a user directly. This applies the same change that Cortex makes when you use Make Admin in Cortex System Manager.

  1. Connect to the Cortex configuration database and find the Cortex Admin security group (it is usually named Admin):

    SELECT Id, Name FROM cortex.SecurityGroups;

  2. Promote the user. Match on username or email address:

    UPDATE cortex.UsersToSecurityGroups
    SET IsAdmin = 1,
        CortexSecurityGroup = '<Admin-Group-Id>',
        UpdatedAt = GETUTCDATE()
    WHERE Username = '<username>' OR EmailAddress = '<email>';
    • Replace <Admin-Group-Id> with the Id you found in step 1.
    • Replace <username> or <email> with the account to promote.

  3. Confirm the account's record has IsDisabled = 0, then have the user sign in. They will have admin access on their next login.