Define a strategy to manage credentials

giohappy commented 6 years ago

GeoNode's superuser, Geoserver admin and PG user credentials must be generated for new deployments.

Should we generate them randomly and make them available to the GeoNode's admin somehow?
or let the user define them through Rancher variables / questions?

giohappy commented 6 years ago

The simplest option for the moment is keep the default credentials (Geoserver, GeoNode and PG) and let the user change them from each UI.

In the future we will consider setting them during deployment, maybe considering stronger security with secrets (see #7)

cezio commented 6 years ago

cezio commented 6 years ago

for the record:

GeoServer has two built-in users, which can be accessed: root and admin
root is a last-resort user, it's password should be generaded and stored in masterpassword file
admin is used in REST APiI and it's credentials should be synchronized between GS and GN. admin user can be customized in GN with GEOSERVER_ADMIN_USER and GEOSERVER_ADMIN_PASSWORD env vars. GS stores credentials/roles in data dir, in data/security/usergroup/default/users.xml and data/security/role/default/roles.xml. At the moment we just change password hash in user entrypoint script in GS image.

giohappy commented 6 years ago

DOcker credentials provided by env

geosolutions-it / geonode-generic