Repository navigation
Using docker secrets for datasource passwords, makes registering first user impossible聽#201
Description
What you did 馃摑
- I run the docker compose example from this project.
- Using information from Passbolts documentation, I replace the datasource password with a secret from a file
- When I start the server, everything works as expected
- I run the command for creating a new user
exec passbolt su -m -c "/usr/share/php/passbolt/bin/cake \ passbolt register_user \ -u <your@email.com> \ -f <yourname> \ -l <surname> \ -r admin" -s /bin/sh www-data - I can see in MariaDBs log, that passbolt does not use the password specified for making the connection
`2023-06-01 11:30:29 7 [Warning] Access denied for user 'passbolt'@'192.168.16.3' (using password: NO)
2023-06-01 11:30:29 8 [Warning] Access denied for user 'passbolt'@'192.168.16.3' (using password: NO)
2023-06-01 11:30:29 9 [Warning] Access denied for user 'passbolt'@'192.168.16.3' (using password: NO)`
- I check with defining the password in cleartext - it works fine.
- I check back again with clean volumes, and it still does not work if I use files for loading the password
- I check that the password is indeed loaded correctly into MariaDB, and here it works fine as well..
What happened 馃挜 馃搵
I assume that somehow the cake server did not get the memo from the datasource password being in the file, and assumes no password is present. MariaDB then denies it.
What you expected to happen
I would expect it to be no difference between reading the password from cleartext in the compose file vs. reading the password from a file.
example-passbolt-compose.yml.txt
Metadata
Metadata
Assignees
Labels
No labels
Activity
garrettboone commentedon Jun 1, 2023
Are you saying that you replaced the file path for a secret with a cleartext string in the compose file? Or that using secrets is not working?
Your config doesn't note as file like:
Or it's duplicated in the compose file. Further help is available in the forum. https://community.passbolt.com/
CBrams commentedon Jun 1, 2023
I replaced the "DATASOURCES_DEFAULT_PASSWORD_FILE" Directive with the direct "DATASOURCES_DEFAULT_PASSWORD" directive, including the password in cleartext instead.
My config has the file reference on line 50-52 :)
garrettboone commentedon Jun 1, 2023
DATASOURCES_DEFAULT_PASSWORD_FILE is the path, the above example shows the file name ....you have a path in the file name.
Like here: https://docs.docker.com/compose/use-secrets/
dlen commentedon Jun 1, 2023
Hi @CBrams !
I think this is related with the environment not correctly set. It is not clear in the docs so we will try to address it, thanks for the heads up.
You should run the following command:
exec passbolt su -m -c "source /etc/environment; /usr/share/php/passbolt/bin/cake \ passbolt register_user \ -u <your@email.com> \ -f <yourname> \ -l <surname> \ -r admin" -s /bin/bash www-dataRelated with #126
dlen commentedon Jun 1, 2023
I confirm the above command works, I'm closing the issue, feel free to reopen if necessary.