Admin Password refused

In conclusion, TimeMachine recovery of the entire system to the status before changing admin password worked well. I recovered the old admin password and it worked for Keychain Access as well.

In details; Just in case the recovery doesn't work and I lose the TimeMachine backups somehow, I copied the TimeMachine backup to another external drive. To do that, however, I needed admin password. So, first I had to reset the admin password.

Note: In my case, the destination for TimeMachine backup was a local partition (probably), so I didn't need network password to access it. If it were in network, for example, you would need password that has been lost at step 8. Then this procedure may not work for you. Before actually try the following steps, it may be good to see if you need password for system recovery, following http://support.apple.com/kb/PH14185 (step 5 in this page is the key), but just cancel when you are asked to choose date and time.

1. Open the Time Machine pane in System Preferences. Choose Time Machine > Open Time Machine Preferences…

2. Slide the Time Machine switch to Off.

3. Restart the Mac with Command + R keys held down to enter Recovery Mode.

4. In Recovery Mode, launch Terminal.app.
5. In Terminal.app, type resetpassword.
6. Choose the admin account and set new password. Verify it.

7. Warning about Keychain will appear.

8. Restart. Now you get admin password at the cost of loosing Keychain password. The server won't work properly any longer.

9. The OS will ask if you want to update Keychain password. Because you don't know the old password. You can't do that. So just choose Continue in the middle.

10. The system will ask Keychain passwords, but you have to ignore them.

11. Connect an external drive that is large enough.

12. If necessary, reformat the drive to Mac OS Extended (Journaled). see http://support.apple.com/kb/ht5096
13. Click the icon of the new backup drive and choose Get Info from the File menu or press Command-I (⌘-I)
14. Make sure Ignore ownership on this volume at the bottom of the Sharing & Permissions: section is not checked.
15. Open a new Finder window. In the Finder sidebar, click the icon of the current backup drive.
16. Open a new Finder window. In the Finder sidebar, click the icon of the new backup drive.
17. Drag the folder Backups.backupdb on the current backup drive to the root level of the new backup drive.
18. Enter an administrator name and password (you needed to reset the admin password for this step), then click OK to start the copying process. This may take some time to complete because all the backups will be copied.

19. After the copy has completed, you can eject the eternal drive.

20. Restart the machine with Command and R keys held down to enter Recovery Mode.

21. In Recovery Mode, Select Restore from a Time Machine Backup, then click Continue.
22. Select the TimeMachine storage.

23. Select the date and time of the backup you want to restore, then follow the onscreen instructions.

24. In my case, I successfully recovered admin password as well as default Keychain password.

I hope this helps someone in the future:

The list of keychains, notably login.keychain, is stored in ~/Library/Preferences/com.apple.security.plist

The system.keychain and similar are found in /Library/Preferences/com.apple.security.plist

If those files have wonky permissions, you'll have problems doing anything. Even if the keychain files themselves are fine, if the OS is unable to edit those two files it just silently fails in weird ways. Notably, Keychain Access will keep forgetting about the whole login chain, and anything you add or remove from it.

This same problem may apply to the keychain itself; if you can't save to it, you likely have wonky permissions.

Note that it appears Disk Utility does not fix this, although I don't know why. It seems you have to manually fix this. You can do this by doing a Get Info on a root folder and reapplying permissions. In my case the problem was that the Owner was wrong because I moved the files from another machine.