Repository navigation
[Feature] Let the Server take the initial admin password without a properties-file round trip #3285
Description
Feature Description (功能描述)
The initial admin password reaches the Server only through auth.admin_pa in rest-server.properties (ServerOptions.java:483). HugeConfig loads that file with Configurations.properties() (HugeConfig.java:218), so the value goes through the properties grammar. The password the Server stores can then differ from the one the operator set.
Measured 2026-10-07 with commons-configuration2 2.10.1 (the version in hugegraph-commons/pom.xml), reading a file through new Configurations().properties(file):
| Written to the file | Read back |
|---|---|
padded |
padded (trimmed) |
two\\back |
two\back (escape processed) |
x\ty |
x, a tab, y |
pässword (UTF-8 bytes) |
pässword (read as ISO-8859-1) |
The Docker entrypoint writes PASSWORD into this file (docker-entrypoint.sh:184), so PASSWORD=pässword creates an admin whose password is pässword.
Proposal, either of:
- Read the initial admin password from a source that is not parsed as properties, for example an environment variable or a file path read as raw UTF-8 (
auth.admin_pa_file), and keepauth.admin_pafor compatibility. - Keep the file and document the contract: printable ASCII, no leading or trailing space, backslashes escaped.
The Helm chart refuses padded, backslash and non-ASCII admin passwords in values.schema.json:824 and its Server wrapper until this changes. The TODO at ServerOptions.java:483 (from #3260) points here.
Related: non-ASCII passwords also fail at Basic login, tracked separately in #3284. #3133 / #3192 cover the entrypoint's own escaping.
Not proposed for 1.8.0: the chart guard covers it, and option 1 adds a config surface.
Activity
arshilkxwork commentedon Oct 14, 2026
#3334, which added
auth.admin_pa_filefor this issue, is now closed. A maintainer asked to defer a separate password-file option (#3334 (comment)): #3327 already fixed the Docker path, and any remaining encoding problem should get a narrow fix to the existingauth.admin_painput path, with round-trip tests. Whether to keep this issue open for that or close it is up to you and the maintainers.bitflicker64 commentedon Oct 14, 2026
Thanks a lot @arshilkxwork, #3334 was really solid work, and it only stopped because the project didn't want a new config option here.
Closing this one, since #3327 fixed the Docker path and #3290 fixed UTF-8 login. The Helm guard and the
ServerOptionsTODO will go in a chart PR once a release has both.Go grab any other issue you like, happy to review all your PRs and help get them merged!