Re-creating the Docker container behavior for initial SuperAdmin enrollment

[sbarnes-tecnica]

Hello!
I'm working on a build script to install fresh instances of EJBCA-CE, and I was wondering how best to get a new install to have the same behavior as the Docker container, where a message box is printed with the initial URL and enrollment code for the initial admin user.

On a fresh install, invoking ejbca.sh:
ejbca.sh ra addendentity --username superadmin --password 6V3oHXxvwWrGq64MF2EI1bepytjW3n7 --dn "CN=SuperAdmin,O=EJBCA" --caname ManagementCA --type=1 --token USERGENERATED
Yields
ERROR: User 'superadmin' already exists in the database.
Even when superadmin.batch is set to false in web.properties.

I can force delete the superadmin user from the command line and add them back with that same command, but this doesn't give quite the same behavior, as you are unable to have the server generate keys if desired.

[svenska-primekey]

What are the ant commands you used to deploy the ear file? If you use the ant runinstall command that would create the superadmin. If you use deployear to only deploy the ear file and then create the management CA, setup tls, and add the superadmin with the above command would get you that similar workflow to the container.

[sbarnes-tecnica]

The commands I'm using:

ant -q clean deployear
ant runinstall
ant deploy-keystore

If I'm understanding you correctly, I should be omitting ant runinstall, and run something like

ant -q clean deployear
/opt/ejbca/bin/ejbca.sh ca init --caname ManagementCA --dn "CN=ManagementCA,O=EJBCA" --tokenType soft --tokenpassword null --tokenName ManagementCA --keyspec rsa --keyspec 2048 -v 3650 -s
/opt/ejbca/bin/ejbca.sh ra addendentity --username tomcat --password SECUREPASSWORDHERE --dn "CN=ejbca.example.com" --subjectaltname="dNSName=ejbca.example.com" --caname ManagementCA --token P12 --certprofile SERVER
/opt/ejbca/bin/ejbca.sh ra setclearpwd --username tomcat --password SECUREPASSWORDHERE
/opt/ejbca/bin/ejbca.sh batch
/opt/ejbca/bin/ejbca.sh ra addendentity --username superadmin --password 6V3oHXxvwWrGq64MF2EI1bepytjW3n7 --dn "CN=SuperAdmin,O=EJBCA" --caname ManagementCA --type=1 --token USERGENERATED
#Not sure about this one
/opt/ejbca/bin/ejbca.sh roles addrolemember --role 'Super Administrator Role' --caname ManagementCA --value superadmin
ant deploy-keystore

I'm assuming this will miss other steps fired off by ant runinstall that I'll have to either run manually or create a new cli.xml.

[svenska-primekey]

Yes that is the path to go on. I have something like this in Ansible that may be of use to see the process too: https://github.com/Keyfactor/ansible-ejbca-signserver-playbooks/blob/main/ansible_ejbca_signsrv/roles/ansible-ejbca-deploy-pki-ce-sample/tasks/main.yml