Class InitialAdminPassword

java.lang.Object
com.iizix.server.user.InitialAdminPassword
public final class InitialAdminPassword extends Object
The generated initial password of an administrator of a built iiziServer (CC-ADMIN-FIRST-PASSWORD, the owner's rulings AP-1 to AP-7 and BK-1 to BK-3 of 2026-10-08): a built server never runs with the public administrator password of createBaseTables.sql.

The password (generate(), AP-1): 32 characters drawn with SecureRandom from ALPHABET, letters and digits without the look-alikes, about 186 bits. It is hashed as every password is (PasswordHasher, through BasicUserInfo.writeGeneratedPassword) and the account must change it at its first sign-in (AP-2).

Shown once (AP-3): on the console past the logger's redirection (Loggers.stdout_println(String)), never through ILog - the server log is kept, rotated and shown in ServerAdmin's Log table - and in the file "initial-admin-password.txt" of the server's working directory, the directory that holds its database, logs and key files: the installation directory of the iiziServer distribution and of the MLS, and C:\iiziServerDebug for the debug server. The file is created readable by the account that runs the server only, before a byte is written: mode 0600 on a POSIX file system, an ACL of that account alone on Windows. It holds the account name, the password and the line saying it is deleted once the password is changed, which every path that replaces a password does (passwordChanged(String)); a start that finds the file while the account no longer has that password deletes it too (SeedPasswordCheck).

The way back (AP-5): the start option -D"iizi.admin.reset"=<account> makes SeedPasswordCheck.reset generate a new password for that administrator at the start, written and shown as above.

Development mode is untouched (AP-6): nothing here runs for it but the start option.

Author:
Christopher Mindus

  • Field Details

    • FILE_NAME

      public static final String FILE_NAME
      The name of the file, in the server's working directory: "initial-admin-password.txt".
      See Also:

    • RESET_PROPERTY

      public static final String RESET_PROPERTY
      The system property of the way back (AP-5): "iizi.admin.reset"=<account>, read at every start.
      See Also:

    • LENGTH

      public static final int LENGTH
      The length of a generated password: 32 characters.
      See Also:

  • Method Details

    • file

      public static Path file()
      Gets the file: "initial-admin-password.txt" in the server's working directory.
      Returns:
      The file, which may not exist.

    • passwordChanged

      public static void passwordChanged(String userName)
      The password of a user was changed and committed: the file is deleted when it names that user (AP-3). Called by every path that replaces a password: the change at a sign-in, the reset link, ServerAdmin's reset. A start deletes a file whose password the account no longer has as well.
      Parameters:
      userName - The user whose password was changed.

    • permissionProblem

      public static String permissionProblem(Path file)
      Tells what is wrong with the permissions of the file: on a POSIX file system the refusal of PushKeyFiles.posixRefusal(Path) (anything granted to group or others); on Windows an ALLOW entry for anyone but the file's owner.
      Parameters:
      file - The file.
      Returns:
      The problem, null when the file is its owner's alone or the file system has neither permissions nor ACLs.