Karavan 4.14.2 how do you set the admin user and password?

[JustonlyAI]

I installed karavan with docker what is the username and password?

[edubencz]

Users:
admin
developer

password (for both):
K@r@v@n414

[mgubaidullin]

Added to docs: https://github.com/apache/camel-karavan/blob/main/docs/WEB_DOCKER.md

[JustonlyAI]

@mgubaidullin @edubencz is there also a way to set this password on deployment?

[mgubaidullin]

Env Var PLATFORM_PASSWORD

[ghost]

I tried to access Apache Camel Karavan after installation with docker compose file. Unfortunately it is not possible to login for the first time after starting. Login with the correct credentials leads to no reaction on the webpage. In the developer mode there are 401-Errors.

I tried to change the standard password with PLATFORM_PASSWORD. Same behavior as with standard password. I tried 4.14,0; 4.12.2; 4.14.5. Always the same - wrong credentials lead to a "Incorrect Username and/or Password!" on the login screen. Correct credentials seemt to to nothing, but leed to 401-errors in the background.

I tried 4.10.2 as well. I guess this version does not have a login screen, because it worked fine directly from the beginning without login.

Two Questions:

1. Any ideas what i can do to enable login for 4.14x versions with docker compose setup?
2. Is there a list of all ENV-Variables available?

[uranshishko]

Your issue is caused by the browser refusing to store the access token cookie. Same behaviour observed in latest release as well.

The server issues the access token via the Set-Cookie header, but the cookie is marked with the Secure attribute. Browsers will only accept Secure cookies over HTTPS, so if you're running the project on http://192.168.4.3:2080, the cookie is never stored. As a result, every authenticated request is sent without the access token, which leads to the 401 Unauthorized responses you're seeing.

If you look closely at the /ui/auth/loginresponse headers in the network tab you will most likely see a warning beside the Set-Cookie header with a message similar to: This attempt to set a cookie via a Set-Cookie header was blocked because it had the "Secure" attribute but was not received over a secure connection.

There are a couple of ways to resolve this:

1. Run the application over HTTPS by hosting it behind a domain name and installing a TLS certificate (for example, using Let's Encrypt, or a Cloudflare Origin Certificate if you're using Cloudflare).
2. Use HTTPS locally by generating a self-signed certificate on your machine and adding it to your operating system's trusted certificate store.

So technically not an issue with the application itself as it was maybe intentionally designed to work this way(?). Devs could maybe optionally allow users to control this behaviour through env variables? Regardless, once the application is being served over HTTPS, the browser will accept the Secure cookie and authentication should work as expected.