Resetting platform credentials (JACE-9000)

Occasionally a situation will arise where you have a functional JACE-9000 controller but no valid credentials or system passphrase. This could be due to a change in building ownership or control contractors. The Platform Account Recovery feature provides you with a secure method of regaining access to the controller without losing station data and configuration.

You should have access to the following items and information before starting this task.

A USB-C cable to connect the controller to your PC.
A terminal emulator (system shell) program, such as PuTTY, installed on your PC.
During the procedure, you will be prompted to provide the Host id and “proof of ownership” for this controller.

Resetting platform credentials is accomplished using a multi-step process that involves using serial shell software plus contacting your Support channel, and interacting with Tridium by phone or email in order to initiate a secure method of validating that you (the serial shell user) are authorized to reset the platform credentials and system passphrase.

Note: The controller must be rebooted to initiate this procedure. This process could take several hours to complete, depending on your access to cell phone or internet service.

If the controller is running, press and hold the SHUTDOWN button until the BEAT light stops blinking (about 5 seconds).
Remove power from the controller.
Connect a USB-C cable from your PC to the controller DEBUG port.
Open a terminal emulator (system shell) program and connect to the controller. See the “Connecting to the controller system shell” topic for details on connecting.
Important:
In this step, you need to monitor the terminal emulator window and respond to prompts using the PC keyboard.
- You have just a few seconds to press the Escape key. If you press Esc too late, you will not get the Boot Options menu and will need to repeat the reboot process.
- If you press Esc after the Boot Options menu appears, the system will ignore further input until an alphabetic character is entered (for example, the letter “a”). If this happens and the menu does not respond to input, do the following:
  1. Enter the letter “a” (you may need to press the keyboard twice) or any other alphabetic (non-numeric) character to exit the Escape mode.
  2. Delete the alphabetic character that you just entered and continue the process as described below.
Power up the controller and during the boot sequence, press Esc when you see the following message: Press ESC to enter boot options....
The Boot Options menu displays, as shown below.
```
Boot Options
------------
1 Reset platform credentials
2.Continue with boot

Enter Choice :_
```

Type 1 in the Enter Choice: field to select “Reset platform credentials”, and enter Y to confirm and continue.

The Platform Access Recovery screen displays, showing the controller’s Host id and a randomly generated Token with additional instructions, as shown.

**********************************
**** Platform Access Recovery ****
**********************************
Host id    : ATLAS-SD-F84C-2E6D-D888-BB87

Token      : AE85-2F72-DA11-260C

Key version: 1

Contact technical support and provide them with the hostId and token.
Token is valid for 24 hours.
   Recovery process will exit if key is not provided within 24 hours.

Would you prefer to enter key in:

1   Single line     (best when key is copied from email)
2   Multiple lines  (best when receiving key over voice)

Enter Choice :

Contact your appropriate Support channel and request credential/system passphrase reset for the Host id shown on-your screen.
When prompted, provide the support representative with the required “proof of ownership” for the controller.
Once proof of ownership is established the support representative will notify Tridium.
When prompted In the Platform Access Recovery screen, enter the customer name. For example, Joe NewBuildingOwner.
Contact Tridium (either via phone or email) and provide the generated token, the Host id, and the customer name entered in the previous step.
The Tridium representative validates your customer identity via Niagara Licensing, and generates a “Signature” for the token/Host id/customer name that includes a Reset Authorization Key. This Signature is sent to you either by phone or email.
CAUTION: The Reset Authorization Key is valid only for 24 hours from the time it is generated. If you do not enter the key in the Platform Access Recovery screen within the 24 hour period, you must start over with step 1 of this procedure to obtain another Key.
Once you have received the Signature, in the Platform Access Recovery screen indicate your preference for entering the Reset Authorization Key in the serial shell window; enter one of the following:
- Enter1 for Single Line (best when the Key is copied from email), and at the “Enter Key” prompt paste the Reset Authorization Key. After checking the key enter v to verify it (or if necessary, enter 1 to edit the key and then v to verify it.)
- Enter2 for Multiple Line (best when receiving the Key over voice), and at the “Enter line x” prompts enter the string of characters as instructed. After checking your entries enter v to verify the key.
The controller uses the previously installed tridium certificate to verify that this Signature was generated by private key for the given token/Host id/customer name values. Afterwards, the system software generates the factory default username/password credentials and default system passphrase.
The serial shell window displays the following text and reboots after the specified amount of time:
```
Verification Passed

System user credentials are reset
Shutdown in 10 seconds
```
Make a serial or platform connection to the controller. On detecting default credentials, the system prompts you to change the default credentials and default system passphrase before completing the platform connection.

On completion, you can login and access the station data and configuration as you normally would.