Re: [Hawkular-dev] Default user, or alternative realm file?

On 03/11/2015 06:35 PM, Matt Wringe wrote: > In LiveOak for the OpenShift cartridge, we had the system generate an > initial default password. So on first login you would have to know the > randomized initial password, and also be forced to set a new password on > the first login. It wasn't too bad on OpenShift since the password was > set it to the Mongodb cartridge's password which was visible in the > OpenShift console. It solved the problem of first-to-access-hijacking > (which in my opinion is a bad situation, things should be secure by > default). > > We could have something setup so that when the server is first started > we look for a property to use for the initial credentials (eg > -Dhawkular.initial.password=foo). If that property is not set, then > generate a password and display it in the logs or in a file somewhere. > When the user would login for the first time, they would need to enter > this password and then be forced to set a real password. If they don't > set the property it could be a bit annoying as they might have to ssh > into a machine to read the file/logs to get the initial password. I thought of that password generation, but finding the password seems like a steep barrier. With docker/VM, it's even worse IMO.

Thomas > > > On 11/03/15 12:55 PM, Thomas Heute wrote: >> Not sure to understand the alternatives but I have comments: >> - Having 'admin' or 'root' for a super user IMO simplifies >> documentation/usage. (I can imagine that a user could forget what >> username he chose as superadmin for instance). >> - We need to force "complex passwords", this is actually a >> product >> requirement >> - Copying a file is a step that needs to be documented and is >> unfriendly + either you need to encode the password (some tool like for >> Wildfly) or worse have the password in clear in a file for import. >> >> So I am a +1 on setting up the superuser password on first request as >> default. An alternative with a preset file (if present) would be >> welcome >> for those who are afraid of first request hijacking. >> >> Thomas >> >> >> >> >> On 03/11/2015 05:26 PM, Juraci Paixão Kröhling wrote: >>> -----BEGIN PGP SIGNED MESSAGE----- >>> Hash: SHA1 >>> >>> All, >>> >>> Alexandre (and others) asked about the possibility of adding a default >>> user on Keycloak for the Hawkular realm. >>> >>> While adding a default user with the requirement of changing the >>> password on the first login is a possibility, I'd rather have an >>> alternative realm file to import during first boot. >>> >>> This means: a dev (or user) have to actively copy this JSON file into >>> standalone/configuration in order to have a default user. >>> >>> The idea is that we wouldn't ship with a default username/password on >>> the main distribution. Having a default username is usually not >>> recommended from the security perspective, as it's half of the >>> information required to login with super power rights (and you would >>> be surprised to know how many admins set their passwords to "admin"). >>> >>> Given these two alternatives, which one would you prefer? Voting is >>> open and I'll take the results on Monday 9am CET (08:00 UTC). >>> >>> [ ] Default user on the main realm JSON file that will ship with >>> Kettle >>> [ ] Alternate JSON realm file with a default user, which can be copied >>> over the default JSON realm file. >>> >>> - - Juca. >>> _______________________________________________ >>> hawkular-dev mailing list >>> hawkular-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/hawkular-dev >> _______________________________________________ >> hawkular-dev mailing list >> hawkular-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/hawkular-dev > _______________________________________________ > hawkular-dev mailing list > hawkular-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/hawkular-dev