ciur / papermerge

Open Source Document Management System for Digital Archives (Scanned Documents)
https://papermerge.com
Apache License 2.0
2.55k stars 267 forks source link

Cannot delete 'admin' account #439

Open RefineryX opened 2 years ago

RefineryX commented 2 years ago

Description I created a new account assigning 'Superuser status' and 'active'. I want this to replace the default 'admin' account however cannot delete the admin account. I have tried both removing and renaming but the account returns on restart.

Expected When deleting the 'admin' account, it should be permanently deleted and not be restored on docker restart.

Info:

ciur commented 2 years ago

This is docker image specific issue. On docker image initialization this script runs from here and creates admin user (in case admin does not exist).

Probably it is a better idea to skip entirely automatic admin user creation and provide user UI to create admin user if not present.

RefineryX commented 2 years ago

Probably it is a better idea to skip entirely automatic admin user creation and provide user UI to create admin user if not present.

I think that is a great idea. For security, want to complete remove any connection with the default username and password, esp when they have already pre-set values (admin/admin). No matter what I do, it but it keeps coming back so I am forced to use the 'admin' username but changed the password.

It would also be great to maybe allow the user to setup a username/pass as part of onboarding when starting a fresh install.

Northguy commented 2 years ago

You could just login as admin, create a new account, assign that new account superuser rights, login with the new account name, revoke superuser access from 'admin' and disable the 'admin' account? Sounds safe enoughwith the exception of the fact that you will keep seeing the disabled admin account in the user overview.