I'm creating a complex web app (written in Nodejs with many containerised instances running in k8s). I may end up decomposing it into microservices down the line but for now it is monolithic.

Regular users will be able to sign up for an account via the web interface, but I need a small number of specific users to have admin privileges. Admin privileges may include inviting new users while in closed beta, or modifying resources belonging to regular users. At the moment, I have a user schema with a 'roles' field, which will allow a regular user to be elevated to an admin role - but how do I 'bootstrap' these users into place when there are no existing admin users?

These admin users need to exist in multiple environments, including testing environments where the db gets regularly wiped, as well as in production where the user should persist until the credentials are revoked (say if the person leaves the company).

The obviously stupid approach would be to just hard-code the creds for one admin user but that is clearly the worst idea of all time. I could manually insert the user into the database outside of the control of the app but allowing access to the db this way seems like it could present data integrity issues.

I'm using Amazon Secrets Manager to inject things like database credentials where they live as environment variables in the pod/container so it occurs to me I could do something similar for admin credentials, but how should the code handle this to create a user?

One option would be to have a function that runs once on startup each time a new instance of the code starts up which grabs the user credentials from AWS, checks if the users exist in the db already, and if they don't create a new user with the Admin role - and when the person leaves I'd need to delete the credentials from AWS and get another admin user to delete them from the app also. Or I could just store a list of known Admin email addresses and when they sign up as a regular user they automatically get the Admin role. Both of these options seem kind of off to me.

Or should the Admin users not be users at all? Should there instead be a separate Admin "login" system, where the credentials are just checked against the AWS creds each time the Admin logs in, instead of creating a regular user in the db? This would mean I would only have to worry about revoking the creds stored in AWS secrets when the user leaves, and the code wouldn't have to redundantly check for existing Admin users each time a new instance spins up. Down side is I'd have to restructure my permissions system a little but this approach seems to be more secure. Are there any negative implications of doing it this way?

  • Is there only going to be one instance of this app? Or can people create new instances? – user253751 Jun 30 '20 at 17:36
  • There will be one 'instance' in the sense that it is a managed service, not an open source project that I expect others to use. But there will be many container instances running, managed by k8s. – Huggzorx Jun 30 '20 at 18:43
  • Then why not just sign up, then modify the database to make yourself an admin? You will only need to do it once. – user253751 Jun 30 '20 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.