How to create roles and superuser in an ASP.NET MVC application in a secure way

Question

This could be considered a duplicate question, as a similar one has already been asked, but I don't like any of the answers, and security was not addressed.

When deploying an ASP.NET MVC app, what's the right way to create roles and a superuser without risks?

Two ways come to my mind: using Application_Start or a custom action (better if with a non-obvious name and not linked).

Anyway, what about with first user's password?

I've seen tons of web apps that happily let the first person to access them to be the superuser; when you put such an app online, you can only pray to be the first to connect.

What is the most secure way to set password?

• Hardcode it in the application?

• Have it randomly generated and then mailed somewhere?

• Have it randomly generated and then saved somewhere on filesystem?

• Have it taken from a file on filesystem?

• Something better that I couldn't figure out?

Answer 1

I use the ASP.NET membership provider and a SQL database.

Upon deploy, I have a script I run that creates my users.

It does mean my site is not "ready for business" until I run the script but I am okay with that.

Kindness,

Dan

Answer 2

Assuming the admin of the application doesn't want to run upload a pre-configured database you could configure an installation password in your web.config which must be set before it is uploaded. Then in your installation pages prompt for this password and the admin credentials. Obviously your installation pages would check for a blank installation password and refuse to proceed.

You could then add an HTTP handler which checks if the application has gone through the installation procedure, refusing to serve any pages other than the ones related to installation until the install is complete.

Answer 3

The best solution to this I have seen is to allow for the creation of a superuser via some installation bits then require the user delete or disable the installation bits for the application to run. Subtext works this way, as did Wordpress (at least the last time I installed it, which might have been back in the 90s).