Documentation
¶
Overview ¶
Package bootstrap creates the first administrative account on a fresh install.
R-046: a fresh installation has no account until somebody claims it. The person who sets the administrator's username and password up in the console (POST /setup, Claim) must present the one-time setup token Pando printed to its log at startup (issue #130); no password is ever printed. An operator who wants the account made unattended supplies PANDO_ADMIN_PASSWORD, and Run makes it at startup instead.
Index ¶
Constants ¶
const AdminUsername = "admin"
AdminUsername is the account created on first run.
Variables ¶
This section is empty.
Functions ¶
func Claim ¶
func Claim(ctx context.Context, users *state.Users, auditor *audit.Writer, setupToken secret.Value, username, displayName string, password secret.Value) (state.User, error)
Claim sets up an unclaimed installation: the first account, as its administrator, with the username and password the person chose (R-046). Refused with state.ErrAlreadySetUp once any account exists.
They chose the password themselves, so it need not be changed at the next sign-in — unlike one supplied through the environment or handed over.
They must also present the setup token (issue #130), which the claim uses up.
Types ¶
type Result ¶
type Result struct {
// Created says Run made the first administrator, from PANDO_ADMIN_PASSWORD.
Created bool
User state.User
// Unclaimed says the installation has no account and is waiting for
// somebody to set one up in the console, with the setup token.
Unclaimed bool
// SetupToken is the token Run just made, for the caller to print. Zero
// when the installation already had one, which cannot be read back:
// SetupTokenMade then says when it was made, so the log can point at it.
SetupToken secret.Value
SetupTokenMade time.Time
}
Result reports what first run produced.
func Run ¶
func Run(ctx context.Context, users *state.Users, grants *state.Grants, db *state.DB, auditor *audit.Writer, supplied secret.Value) (Result, error)
Run seeds the local identity adapter and, if no account exists and the operator supplied PANDO_ADMIN_PASSWORD, the first administrator.
Idempotent: on every start after the first it finds a user and does nothing. The check is "any user at all" rather than "the admin user" so that deleting the seeded admin after creating a real one does not make it reappear on the next restart.
Without a supplied password it creates no account and reports Unclaimed: the administrator is set up in the console, by whoever has the setup token (R-046). Run makes that token the first time and returns it to be printed. It is not a password: it works once, only while there is no account, and only on the setup form, so the log line holding it stops mattering the moment it is used.
A supplied password still must be changed at first sign-in, because an environment variable is not a safe place for one — it is in the Compose file, in `docker inspect`, and inherited by every child process.
Under state.FirstAccountLock. Replicas started together each run this, and without the lock both found no account and both made one; the second failed on the username and that replica did not start (issue #72).
Source Files