Skip to main content

Reset root password

1. Overview​

CSGHub uses Casdoor as its unified authentication system. The root administrator password is stored in the Casdoor database. The following methods can be used to reset the root password when it is lost or needs to be changed.

2. Reset via Casdoor Admin Console​

If you can log in with your current password, you can change it directly in the Casdoor admin console.

  1. Access the Casdoor admin console (e.g., https://casdoor.example.com)
  2. Log in with the root account
  3. Go to User Management → Users
  4. Find the user root
  5. Click edit, then select Edit Password
  6. Enter the new password

3. Reset via SQL​

When you cannot log in to the Casdoor admin console, you can update the root user's password directly in the database by executing a SQL command.

3.1 Install htpasswd​

# macOS (built-in, no installation required)
# Ubuntu / Debian
sudo apt install -y apache2-utils
# CentOS / RHEL
sudo yum install -y httpd-tools

3.2 Generate password hash and update database​

ROOT_PASSWORD="your-new-password"
ROOT_HTPASSWD=$(htpasswd -bnBC 10 "" "$ROOT_PASSWORD" | tr -d ':\n')
kubectl exec -n csghub csghub-postgresql-0 -c postgresql -- \
  psql -U csghub -d csghub_casdoor -c \
  "UPDATE \"user\" SET password='${ROOT_HTPASSWD}' WHERE name = 'root';"

3.3 Update the Secret​

To prevent the password from being overwritten during the next Helm upgrade, update the corresponding Secret:

kubectl patch secret -n csghub csghub-casdoor-init --type='json' \
  -p="$(jq -n \
    --arg pass "$(echo -n "$ROOT_PASSWORD" | base64)" \
    --arg htpasswd "$(echo -n "$ROOT_HTPASSWD" | base64)" \
    '[
      {"op": "replace", "path": "/data/INIT_ADMIN_PASSWORD", "value": $pass},
      {"op": "replace", "path": "/data/INIT_ADMIN_HTPASSWD", "value": $htpasswd}
    ]')"

4. Configure initial password via Helm values​

During initial deployment, you can specify the root password in the values file:

casdoor:
  admin:
    name: "root"
    password: "your-password"
caution

This only applies to the initial deployment. Existing passwords will not be overwritten.

5. Password synchronization notes​

CSGHub has two Casdoor users:

UsernamePurpose
rootAdministrator account for logging into CSGHub
adminCasdoor admin console account for managing authentication configuration

The root user's password is only written to the database during the initial deployment via Casdoor's init_data.json. Both root and admin users need to be updated to ensure both accounts can log in normally.