Console Accounts

Console accounts sign in to the Web UI.

First account ​

Console accounts are stored in auth.db with PBKDF2-SHA256 password hashes. The first start without accounts creates an administrator with a random one-time password, logged once and changed at first sign-in. The account name is admin- plus eight random characters, or admin when Console:SeedPassword or the legacy Console:AdminApiKey (PORTWAY_ADMIN_KEY) is set. Console:SeedPassword sets a fixed password without a forced change, for demo instances only.

The legacy Console:AdminApiKey is not used for sign-in. It enables the console like Console:Enabled and can be removed, also from Settings → Security → Deployment & Access.

Account roles ​

The role is read from auth.db on every request, not from the session cookie; a demotion applies to the next request.

Sessions are signed with portway.key, created next to auth.db. Deleting it ends all sessions.

Recovering an account ​

Account recovery runs from the shell, in the directory that contains auth.db:

./PortwayApi accounts list
./PortwayApi accounts password <username> <new-password>
./PortwayApi accounts create <username> <password> [administrator|viewer]

.\PortwayApi.exe accounts list
.\PortwayApi.exe accounts password <username> <new-password>
.\PortwayApi.exe accounts create <username> <password> [administrator|viewer]

docker exec <container> dotnet /app/PortwayApi.dll accounts list
docker exec <container> dotnet /app/PortwayApi.dll accounts password <username> <new-password>
docker exec <container> dotnet /app/PortwayApi.dll accounts create <username> <password> [administrator|viewer]

Further subcommands: promote, demote, enable, disable, delete. A command that would leave no active administrator is refused.

Related topics ​

• Web UI
• Single Sign-On
• Security