Setting an unencrypted admin password via CFConfig

dmurphy · March 21, 2025, 5:28pm

I’m not sure if I should comment here or the ticket because it is tangentially related. What about the LUCEE_ADMIN_PASSWORD env variable? Having LUCEE_ADMIN_PASSWORD set in an .env file doesn’t get picked up (just tried it), presumably because of the same reason the LUCEE_INSPECT_TEMPLATE doesn’t - hierarchy. I don’t want the password saved in plain text anywhere, obviously, so where is the best place to have the password set?

It looks like the .CFConfig.json sets a hspw which is a hashed password. Do I leave that in source control? Or do I use something like "hspw":"{env:LUCEE_ADMIN_PASSWORD}" but have to keep the hashed value in the .env variable? (So then no one will know what it actually is if they need it?)

I’m probably being dumb here, ha. Just wondering the best way to go about the Lucee Admin password.

Zackster · March 23, 2025, 5:01pm

You can set an unencrypted password in CFConfig.json via adminPassword

Or just drop a password.txt in lucee-server/context

github.com

lucee/Lucee/blob/6.2/core/src/main/java/lucee/runtime/config/PasswordImpl.java

/**
 * Copyright (c) 2015, Lucee Association Switzerland. All rights reserved.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either 
 * version 2.1 of the License, or (at your option) any later version.
 * 
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 * 
 * You should have received a copy of the GNU Lesser General Public 
 * License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 * 
 */
package lucee.runtime.config;

import java.io.IOException;

This file has been truncated. show original

Zackster · March 25, 2025, 4:12pm

Docs updated

dmurphy · March 25, 2025, 10:24pm

Thanks for the info. Maybe I’m doing something wrong, but I just tested it out, and it seems the key is pw, not adminPassword. The pair to hspw I suppose?

Works:
"pw": "blehblah"

Shows password field but always gives “No access, password is invalid” error:
"adminPassword": "blehblah"
"password": "blehblah"

No Password set yet!!:
"adminPasswordDefault": "blehblah"
"defaultAdminPassword": "blehblah"

dmurphy · March 25, 2025, 10:32pm

I can also confirm that doing "pw": "{env:LUCEE_ADMIN_PASSWORD}" and then setting an env variable of the same name also works.

Zackster · March 25, 2025, 11:05pm

ah I think I must of misread the code, there’s a fair bit in there, i’ll update docs

dmurphy · March 26, 2025, 1:00am

Thanks for the help on this! It’s exactly what we were looking for.