Completely locked out of the admin account with FreeIPA

I have a FreeIPA server set up with a single replica. The admin account has been locked. Here's the log from a kinit admin:

[root@idm-00 ~]# kinit admin
kinit: Client's credentials have been revoked while getting initial credentials

Jun 26 13:04:08 idm-00. krb5kdc(info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) : LOCKED_OUT: admin@ for krbtgt/@, Client's credentials have been revoked

I don't have another admin user on the system, but I do have root access to the server itself. Is it possible to recover from this?