First admin and sign-in

The Licensing Server ships a built-in sign-in: a standards-based issuer embedded in the server, so the console works with no external identity dependency. Teams with an identity provider can swap it in by configuration.

The first administrator

# one-time: create (or repair) the first console administrator; prints a
# temporary password ONCE - your install kit's NEXT-STEPS.txt carries the exact
# command for your setup
podman exec -it sws-licensing node /opt/sws/server/server.js create-admin you@example.com

The command is idempotent and prints a temporary password once; the first sign-in replaces it. Running it again for the same email repairs the account and resets the password, which makes it the break-glass path as well: if you are locked out of your only admin account, run create-admin again from the host.

Further team members are invited from the console (Users), exactly as in the cloud console. Invitations arrive by email in smtp mode, or appear in the server log in log mode.

Credential rules

The built-in sign-in enforces passwords of at least 8 characters with upper- and lower-case letters, a digit, and a symbol. It locks the account out after repeated failures, with a cool-down and a deliberately generic failure message so accounts cannot be enumerated by probing. Password reset works by email with a time-limited link, and requires smtp email mode.

Bringing your own identity provider

The console speaks standard OpenID Connect discovery, so replacing the built-in issuer with your own is configuration only: disable the local issuer and point the console's issuer settings at your realm. Keycloak is the proven reference. Claim mapping (username, groups) is configurable, and the defaults match the built-in issuer. Your provider then owns passwords, MFA, and session policy; the create-admin verb is only needed to grant the admin role the first time.

What does not carry over from the cloud

Console accounts are per deployment. If you migrated from the cloud service, your licensing data moved, but cloud console identities did not; create your admins fresh here. Your customers' license activations are unaffected, since end-user devices never had console accounts.