opschain passwd

Included from Basic tier

Change the logged-in user's own password on the targeted server, over the v2 AuthService.ChangePassword RPC, authenticated with the stored login token. Local users only — directory (LDAP) passwords are managed in the directory, and the server refuses directory-managed identities with a named error. In the GUI the same change is Preferences → Password (profile menu) — local users only, the same refusal for a directory identity.

Interactively, the current and new passwords are prompted without echo, and the new password is retyped for confirmation:

opschain passwd
Current password:
New password:
Retype new password:
Password changed.

For scripts, each password is read from a named environment variable — the name is passed, never the value, so no password lands in shell history or the process list:

opschain passwd --current-password-env OLD_PW --new-password-env NEW_PW

Piped stdin also works (one password per line: current, new, confirmation — the confirmation line is only read when the new password was prompted rather than taken from the environment).

Under the rotate-on-first-login confinement

A principal confined to the password-change flow — the hardened posture's bootstrap admin on first login, or a local user whose password is older than security.password_max_age_days — has every other command refused with permission_denied: your password must be rotated before this server accepts other requests: change it with 'opschain passwd', then retry. This command is that remedy: while confined, the server serves exactly the password change and the identity probe on each API lane (the v2 AuthService.ChangePassword this command rides and Introspect; the v1 POST /api/users/me/password and GET /api/me), so opschain login and opschain passwd work and nothing else does. A successful change lifts the confinement for the same session at once — no fresh login is needed. See opschain docs identity ("Password policy").

Flags

Flag	Meaning
--current-password-env <NAME>	Environment variable holding the current password.
--new-password-env <NAME>	Environment variable holding the new password. Supplying it skips the retype confirmation.

Named errors

• passwd needs a server — pass --server <url>, set OPSCHAIN_SERVER, or 'opschain context use <name>'
• the environment variable <NAME> is not set (or empty)
• the new passwords do not match
• no password provided (pipe it on stdin, or run from a terminal)

All exit 2. A wrong current password, a new password the server's policy refuses (minimum length, history), or a directory-managed identity exit 1 with the server's JSONAPI error.

Exit codes

Code	Meaning
0	Password changed.
1	The server refused the change or was unreachable.
2	Usage error (see Named errors).

See also

• opschain docs cli/login — the stored token this command authenticates with.