Accessing Magento 2 Admin Without a Password: A Practical Guide

If you're locked out of your Magento 2 admin panel and traditional recovery methods aren't working, using a root script can help you regain access. This method is particularly useful during development or for educational purposes. However, it's important to note that using this script in a live environment poses significant security risks.

Why Use a Root Script to Access Magento 2 Admin?

There are several scenarios where this approach is beneficial:

• Password Recovery: When standard recovery options fail.
• Development and Testing: To quickly access the admin panel without dealing with passwords.
• Learning and Experimentation: To understand Magento's authentication mechanisms.

Remember, this method should only be used in a controlled environment.

Creating the Root PHP Script

• Navigate to the Root Directory: Go to your Magento 2 installation's root directory.
• Create the Script File: Create a new PHP file, e.g., adminLogin.php.
• Insert the Script: Paste the following code into the file:

<?php

use Magento\Framework\App\Bootstrap;

require __DIR__ . '/../app/bootstrap.php';

class AdminLoginApp extends \Magento\Framework\App\Http implements \Magento\Framework\AppInterface {

public function launch() {

$areaCode = 'adminhtml';

$username = 'admin'; // Replace with your admin username

$this->_request->setPathInfo('/admin');

$this->_state->setAreaCode($areaCode);

$this->_objectManager->configure($this->_configLoader->load($areaCode));

$user = $this->_objectManager->get('Magento\User\Model\User')->loadByUsername($username);

$session = $this->_objectManager->get('Magento\Backend\Model\Auth\Session');

$session->setUser($user);

$session->processLogin();

if ($session->isLoggedIn()) {

$remoteAddress = $this->_objectManager->get('Magento\Framework\HTTP\PhpEnvironment\RemoteAddress');

$adminSessionInfo = $this->_objectManager->create('Magento\Security\Model\AdminSessionInfo');

$adminSessionInfo->setData('session_id', $session->getSessionId());

$adminSessionInfo->setData('user_id', $user->getUserId());

$adminSessionInfo->setData('ip', $remoteAddress->getRemoteAddress());

$adminSessionInfo->setData('status', '1');

$adminSessionInfo->save();

$cookieManager = $this->_objectManager->get('Magento\Framework\Stdlib\CookieManagerInterface');

$cookieValue = $session->getSessionId();

if ($cookieValue) {

$sessionConfig = $this->_objectManager->get('Magento\Backend\Model\Session\AdminConfig');

$cookiePath = str_replace('adminLogin.php', 'index.php', $sessionConfig->getCookiePath());

$cookieMetadata = $this->_objectManager->get('Magento\Framework\Stdlib\Cookie\CookieMetadataFactory')

->createPublicCookieMetadata()

->setDuration(3600)

->setPath($cookiePath)

->setDomain($sessionConfig->getCookieDomain())

->setSecure($sessionConfig->getCookieSecure())

->setHttpOnly($sessionConfig->getCookieHttpOnly());

$cookieManager->setPublicCookie($session->getName(), $cookieValue, $cookieMetadata);

}

$backendUrl = $this->_objectManager->get('Magento\Backend\Model\UrlInterface');

$path = $backendUrl->getStartupPageUrl();

$url = $backendUrl->getUrl($path);

$url = str_replace('adminLogin.php', 'index.php', $url);

header('Location: ' . $url);

exit;

}

return $this->_response;

 }

}

$bootstrap = Bootstrap::create(BP, $_SERVER);

$app = $bootstrap->createApplication('AdminLoginApp');

$bootstrap->run($app);

• Modify the Username: Replace 'admin' with your actual admin username.
• Execute the Script: Access the script via your browser:

<https://emmo.net.co/a61c7bc4_admin

Important Considerations

• Security Risks: This script bypasses Magento's authentication, making it a potential target for unauthorized access.
• Environment Usage: Only use this method in development or testing environments.
• File Deletion: After use, delete the adminLogin.php file to prevent unauthorized access.

Summary

Using a root script to access the Magento 2 admin panel without a password can be a lifesaver in certain situations. However, it's crucial to understand the associated risks and use this method responsibly. For ongoing access needs, exploring more secure solutions like the Admin Auto Login module is advisable.