Create the first administrator

A newly set up data service doesn't yet know any person who may administer it. You therefore create the first administrator once with a command on the server; after that, you do everything else in the administration app.

The init-admin command runs on the service's computer, not over the network. It needs the service's store file and master key and thus the rights of an administrator of this computer—that's the proof that you may administer the service. It creates:

1. the rule verwaltung with the admin right (or uses an existing rule with this right),
2. a person with this rule,
3. a personal key for the person.

The person sets up the second factor themselves the first time they sign in to the administration application; administration always requires it.

Prerequisites: the service is installed and has an administration store with a master key (Gateway:Store), and AuthMode contains PersonalKey. Whether the service is already running doesn't matter.

After installation, the console with init-admin opens by itself if Ersten Administrator jetzt anlegen (Create the first administrator now) was selected; later, through the Start menu entry WKL Database Gateway > Ersten Administrator anlegen (Create first administrator) (asks for administrator rights). It asks for the name and continues with step 3. Manually:

1. On the service's computer, open a command prompt or PowerShell as an administrator and change to the service's program directory.

2. Run:

   .\Wkl.Data.Gateway.exe init-admin --name "Jane Doe"

3. The command shows the personal key (starts with wkl_) once. Pass it on to the person in a secure way, or enter it together with them.
4. The person signs in to the administration app with this key, see “Sign in to the administration app” (documentation of the administration app). Instead of asking for a code, the first time the application asks for setup: the card Zweiten Faktor einrichten (Set up second factor) shows a QR code. The person scans it with their authenticator app, enters the first code, and selects Einrichten (Set up). They're then signed in.

Result: the person can administer; at every further sign-in, the application asks for the code from the app. You can check this on the server with:

.\Wkl.Data.Gateway.exe admin-status

• Deadline. Setup during sign-in is possible for 24 hours after the key is issued (setting totp_enrol_hours). After that, issue a new key with init-admin --name … --force.
• Set it up right at the server. With --totp, the command shows the QR code in the console and saves only when a code from the app matches. This makes sense if the person is sitting next to you.
• With the Windows account. --windows DOMAIN\name sets the person's own Windows account and assigns that account to the rule verwaltung. The person can then also sign in with Windows, as long as Windows sign-in is turned on (AuthMode includes Windows; otherwise, the command tells you). With --no-key, the command issues no key, and Windows is the only way into administration.
• Only once. As long as someone can administer, init-admin refuses without --force. You create further administrators in the administration app: a person with the rule verwaltung, see “Create a person and issue a key” (documentation of the administration app). Create at least two so that the absence of one person doesn't lock administration out.
• Read-only administration, for an audit, for example: a second rule with admin whose “Nur lesen” (Read only) check box is selected.

• Install the data service
• Regain access when administration is locked out
• “Set up or reset the second factor” (documentation of the administration app)
• Reference: First administrator and recovery, Sign-in policy and second factor