checkId: check.users.superuser.exists plugin: stellaops.doctor.authority severity: fail tags: [authority, user, admin, superuser, security]

Super User Exists

This Doctor check verifies that at least one Authority administrator (super user) is configured, so that there is an account capable of performing privileged operations. It runs only when the Standard authentication plugin is enabled.

What It Checks

Aggregates the configured administrators from:

• The bootstrap username (Authority:Bootstrap:Username).
• Explicit administrators (Authority:Users:Administrators).
• Admin role assignments (Authority:Roles:Administrators).

Outcomes:

• Fail — no administrator is configured and auto-bootstrap is disabled.
• Info — no administrator is configured but auto-bootstrap is enabled (the bootstrap user becomes an admin on first startup).
• Pass — one or more administrators are configured.

Why It Matters

Privileged actions — managing tenants, rotating signing keys, approving releases, configuring policy — require an administrator. With no super user and no auto-bootstrap, the platform has no account that can perform these operations, and recovery requires direct database edits.

Common Causes

• No users assigned to the administrator role.
• Bootstrap user not configured and auto-bootstrap disabled.
• Administrators listed under the wrong configuration section.

How to Fix

Docker Compose

environment:
  Authority__Bootstrap__Enabled: "true"
  Authority__Bootstrap__Username: "admin"

Bare Metal / systemd

Edit /etc/stellaops/appsettings.json:

{
  "Authority": {
    "Users": { "Administrators": ["admin"] }
  }
}

Or create a super user with the wizard:

stella setup --step users

Kubernetes / Helm

authority:
  users:
    administrators:
      - admin

Verification

stella doctor run --check check.users.superuser.exists

Related Checks

• check.authority.bootstrap.exists— verifies a bootstrap user can be provisioned
• check.users.password.policy— validates the password policy hardening