Steps

superadmin is a rescue account that bypasses the rights system entirely. It is disabled by default, because a password left behind is a security hole, so enable it only to recover a wiki whose rights have become unusable.

1. Stop the XWiki instance.
2. Open xwiki/WEB-INF/xwiki.cfg, uncomment the xwiki.superadminpassword property and give it a password:

   xwiki.superadminpassword=system

3. XWiki 18.8.0+

   Replace that password with a hash of it, so that the configuration file no longer holds the password itself. Produce the hash, then write it after the key of the algorithm that produced it, between braces:

   htpasswd -bnBC 10 "" system | tr -d ':\n'

   pip install bcrypt
   python -c "import bcrypt, getpass; print(bcrypt.hashpw(getpass.getpass().encode(), bcrypt.gensalt(rounds=10)).decode())"

   xwiki.superadminpassword={bcrypt}$2y$10$0RH05BOGfvbaI7ICDc/85OTECaD07U9ebVw.lYnNGCGC/v9UVT75.

4. Restart the XWiki instance, then log in with superadmin as the "Username" and the password you chose:

   

5. Open the drawer and check that superadmin is the current user:

   

FAQ

Does the user name have to be written exactly "superadmin"?

No. The match ignores case and accepts a full reference, so superadmin, XWiki.superAdmin and xwiki:XWiki.superadmin all work.

Does the account work on a subwiki?

Yes. Whichever wiki you log in from, you are authenticated as the main wiki's XWiki.superadmin.

Can I still put the password in clear text?

Yes. A value that does not start with the key of a supported algorithm between braces is compared as it is, so existing configurations keep working.

Which algorithms can I use for the hash?

Those listed in Password Property. The superadmin password must always carry the {algorithm} prefix and use the new documented format.

Related

• Rights Resolution
• Authentication
• Password Property