checkId: check.authority.bootstrap.exists plugin: stellaops.doctor.authority severity: fail tags: [authority, user, bootstrap, admin, security]

Bootstrap User Exists

This Doctor check verifies that the Authority service can provision (or has been told to provision) an initial bootstrap/admin user, so that a fresh install is not left with no way to log in. It runs only when the Standard authentication plugin is enabled (LDAP/OIDC users are managed by the external directory).

What It Checks

Reads the Authority bootstrap configuration:

Bootstrap username/email (Authority:Bootstrap:Username / Authority:Bootstrap:Email, or the Authority:Plugins:Standard:Bootstrap:* aliases).
Auto-bootstrap flag (Authority:Bootstrap:Enabled, defaulting to enabled).

Outcomes:

Fail — auto-bootstrap is disabled and no bootstrap user is configured (the system cannot create an initial admin).
Info — auto-bootstrap is enabled and no explicit user is configured (a default admin will be created on first startup).
Warn — a bootstrap user is partially configured (username or email missing).
Pass — a bootstrap user is fully configured.

Why It Matters

On a fresh deployment, the bootstrap user is the only way to obtain the first administrator session. If auto-bootstrap is disabled and no user is configured, the platform comes up with an empty user table and no login path, forcing a manual database intervention to recover.

Common Causes

Authority:Bootstrap:Enabled set to false with no replacement user configured.
Bootstrap username configured without an email (or vice versa).
Bootstrap settings placed under the wrong configuration path.

How to Fix

Docker Compose

environment:
  Authority__Bootstrap__Enabled: "true"
  Authority__Bootstrap__Username: "admin"
  Authority__Bootstrap__Email: "admin@example.com"

Bare Metal / systemd

Edit /etc/stellaops/appsettings.json:

{
  "Authority": {
    "Bootstrap": {
      "Enabled": true,
      "Username": "admin",
      "Email": "admin@example.com"
    }
  }
}

Or create the user with the wizard:

stella setup --step users

Kubernetes / Helm

authority:
  bootstrap:
    enabled: true
    username: admin
    emailSecret: "stellaops-bootstrap-email"

Verification

stella doctor run --check check.authority.bootstrap.exists

check.users.superuser.exists— verifies at least one administrator exists
check.authority.plugin.configured— verifies the Standard plugin is enabled