Bootstrap Administrators

Bootstrap administrators are created automatically when RAMP starts for the first time. This ensures you have immediate administrator access without needing to manually create users in the database.

Features

• Auto-created on first startup
• Supports all authentication providers (RAMP, OIDC, LDAP, Windows, ADFS)
• Automatically assigned Administrator role
• Multiple admins supported
• Safe re-runs (won’t duplicate existing users)

---

When to Use Bootstrap Admins

Use Bootstrap Admins For:

• Initial RAMP deployment
• Disaster recovery scenarios
• Automated deployments (Docker, Kubernetes)
• Development/testing environments
• Ensuring admin access after database restore

Don’t Use Bootstrap Admins For:

• Adding users after initial setup (use web UI instead)
• Production password management (change after first login)
• Long-term credential storage (rotate immediately)

---

Quick Start — RAMP Native Auth

Edit appsettings.json

{
  "Bootstrap": {
    "Administrators": [
      {
        "IdentityProvider": "RAMP",
        "Username": "admin",
        "Email": "admin@yourcompany.com",
        "Password": "Passw0rd"
      }
    ]
  }
}

Start RAMP

cd src/RAMP.API
dotnet run

Check Logs

Look for bootstrap confirmation:

[INFO] Checking bootstrap administrators...
[INFO] Bootstrap administrator created: admin
[INFO] Assigned Administrator role to: admin

First Login

1. Navigate to RAMP login page
2. Username: admin
3. Password: Passw0rd
4. Immediately change password after first login

---

Configuration by Authentication Provider

RAMP Native

{
  "Bootstrap": {
    "Administrators": [
      {
        "IdentityProvider": "RAMP",
        "Username": "admin",
        "Email": "admin@yourcompany.com",
        "Password": "SecurePassword123!"
      }
    ]
  }
}

Requirements:

• Password must meet complexity requirements:
  • Minimum 8 characters
  • At least 1 uppercase letter
  • At least 1 lowercase letter
  • At least 1 digit
  • At least 1 special character

OIDC

{
  "Bootstrap": {
    "Administrators": [
      {
        "IdentityProvider": "OIDC",
        "Username": "john.doe@yourcompany.com",
        "Email": "john.doe@yourcompany.com"
      }
    ]
  }
}

Note

No password needed — user authenticates via external IdP.

How it works:

1. User specified in bootstrap config
2. When user first logs in via OIDC
3. RAMP auto-provisions user account
4. Administrator role is automatically assigned

LDAP

{
  "Bootstrap": {
    "Administrators": [
      {
        "IdentityProvider": "LDAP",
        "Username": "jdoe",
        "Email": "jdoe@contoso.com"
      }
    ]
  }
}

Note

Username should match LDAP username (sAMAccountName for AD, uid for OpenLDAP).

Windows

{
  "Bootstrap": {
    "Administrators": [
      {
        "IdentityProvider": "Windows",
        "Username": "CONTOSO\\jdoe",
        "Email": "jdoe@contoso.com"
      }
    ]
  }
}

Note

Username must include domain in DOMAIN\username format.

ADFS

{
  "Bootstrap": {
    "Administrators": [
      {
        "IdentityProvider": "ADFS",
        "Username": "john.doe@contoso.com",
        "Email": "john.doe@contoso.com"
      }
    ]
  }
}

Note

Username should match the ADFS claim value (typically email or UPN).

---

Multiple Bootstrap Administrators

You can configure multiple administrators across different identity providers:

{
  "Bootstrap": {
    "Administrators": [
      {
        "IdentityProvider": "RAMP",
        "Username": "localadmin",
        "Email": "localadmin@yourcompany.com",
        "Password": "LocalAdmin@123"
      },
      {
        "IdentityProvider": "OIDC",
        "Username": "john.doe@yourcompany.com",
        "Email": "john.doe@yourcompany.com"
      },
      {
        "IdentityProvider": "LDAP",
        "Username": "jsmith",
        "Email": "jsmith@contoso.com"
      }
    ]
  }
}

Use Case:

• Local admin for emergency access
• OIDC/LDAP admins for regular use
• Multiple team members as admins

---

Secure Configuration

User Secrets (Dev)

Store passwords securely during development:

cd src/RAMP.API

# Store bootstrap password
dotnet user-secrets set "Bootstrap:Administrators:0:Password" "DevAdmin@123"

Or use appsettings.Development.json:

{
  "Bootstrap": {
    "Administrators": [
      {
        "IdentityProvider": "RAMP",
        "Username": "devadmin",
        "Email": "devadmin@localhost",
        "Password": "DevAdmin@123"
      }
    ]
  }
}

Environment Variables (Prod)

# Linux/Mac
export Bootstrap__Administrators__0__Username="admin"
export Bootstrap__Administrators__0__Email="admin@yourcompany.com"
export Bootstrap__Administrators__0__Password="ProductionAdmin@123"
export Bootstrap__Administrators__0__IdentityProvider="RAMP"

# Windows
set Bootstrap__Administrators__0__Username=admin
set Bootstrap__Administrators__0__Email=admin@yourcompany.com
set Bootstrap__Administrators__0__Password=ProductionAdmin@123
set Bootstrap__Administrators__0__IdentityProvider=RAMP

Azure Key Vault

{
  "AzureKeyVault": {
    "Enabled": true,
    "VaultUri": "https://your-ramp-vault.vault.azure.net/"
  }
}

Store secrets:

• Bootstrap--Administrators--0--Password
• Bootstrap--Administrators--0--Username
• Bootstrap--Administrators--0--Email

---

Docker Deployment

docker-compose.yml

version: '3.8'
services:
  ramp-api:
    image: ramp-api:latest
    environment:
      - Bootstrap__Administrators__0__IdentityProvider=RAMP
      - Bootstrap__Administrators__0__Username=admin
      - Bootstrap__Administrators__0__Email=admin@yourcompany.com
      - Bootstrap__Administrators__0__Password=${RAMP_ADMIN_PASSWORD}
    ports:
      - "5165:8080"

.env file

RAMP_ADMIN_PASSWORD=SecureAdminPassword123!

Run

docker-compose up -d

---

Kubernetes Deployment

secret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: ramp-bootstrap-secret
type: Opaque
stringData:
  admin-password: "SecureAdminPassword123!"

deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ramp-api
spec:
  template:
    spec:
      containers:
      - name: ramp-api
        image: ramp-api:latest
        env:
        - name: Bootstrap__Administrators__0__IdentityProvider
          value: "RAMP"
        - name: Bootstrap__Administrators__0__Username
          value: "admin"
        - name: Bootstrap__Administrators__0__Email
          value: "admin@yourcompany.com"
        - name: Bootstrap__Administrators__0__Password
          valueFrom:
            secretKeyRef:
              name: ramp-bootstrap-secret
              key: admin-password

---

How Bootstrap Works

Startup Process

1. RAMP API starts
2. Reads Bootstrap:Administrators configuration
3. For each administrator:
   • Checks if user already exists (by username)
   • If user doesn’t exist:
     • Creates new user account
     • Sets identity provider
     • For RAMP users: hashes and stores password
     • Assigns Administrator role
   • If user exists:
     • Skips creation (no duplicate)
     • Ensures Administrator role is assigned
4. Logs results

Re-run Safety

Bootstrap is safe to run multiple times:

• Existing users are not modified
• No duplicate users created
• Administrator role is ensured
• Passwords are NOT updated on re-run

---

Troubleshooting

Bootstrap admin not created

Check 1: Verify configuration syntax

{
  "Bootstrap": {
    "Administrators": [
      {
        "IdentityProvider": "RAMP",
        "Username": "admin",
        "Email": "admin@example.com",
        "Password": "Passw0rd"
      }
    ]
  }
}

Check 2: Check application logs for bootstrap messages

Check 3: Verify password requirements (RAMP users only)

• Minimum 8 characters
• Uppercase + lowercase + digit + special character

Cannot log in with bootstrap admin

Check 1: Verify username/password — usernames are case-sensitive, no extra spaces

Check 2: Check database

SELECT * FROM Users WHERE Username = 'admin';

Check 3: Verify role assignment

SELECT u.Username, ur.RoleId
FROM Users u
JOIN UserRoles ur ON u.Id = ur.UserId
WHERE u.Username = 'admin';

Password doesn’t meet requirements

Error: “Password must have at least one uppercase letter”

Ensure password contains:

• Uppercase: A-Z
• Lowercase: a-z
• Digit: 0-9
• Special: !@#$%^&*()
• Length: 8+ characters

Example valid passwords:

• Passw0rd
• SecurePassword1!
• Bootstrap#2024

---

Security Best Practices

1. Change Default Password Immediately

1. Log in with bootstrap credentials
2. Navigate to Settings -> Change Password
3. Set a strong, unique password
4. Store securely (password manager)

2. Remove Bootstrap Config After Initial Setup

{
  "Bootstrap": {
    "Administrators": []
  }
}

Or delete the entire Bootstrap section after first deployment.

3. Use Strong Passwords

• Minimum 12 characters (not just 8)
• Mix of character types
• Avoid common words/patterns
• Use password generator

4. Secure Credential Storage

• Never commit passwords to source control
• Use environment variables or secrets management
• Rotate credentials after initial setup

5. Limit Bootstrap Admins

• Create only the minimum number needed
• Prefer external IdP accounts over RAMP native
• Use individual accounts (not shared)

6. Audit Bootstrap Actions

Check audit logs after deployment:

SELECT * FROM AuditLogs
WHERE Action LIKE '%Bootstrap%'
ORDER BY Timestamp DESC;

---

Common Scenarios

Scenario 1: Initial Deployment

{
  "Bootstrap": {
    "Administrators": [
      {
        "IdentityProvider": "RAMP",
        "Username": "admin",
        "Email": "admin@yourcompany.com",
        "Password": "ChangeMe@123"
      }
    ]
  }
}

After deployment:

1. Log in as admin
2. Change password
3. Create individual user accounts
4. Remove bootstrap config

Scenario 2: OIDC + Emergency Access

{
  "Bootstrap": {
    "Administrators": [
      {
        "IdentityProvider": "OIDC",
        "Username": "john.doe@yourcompany.com",
        "Email": "john.doe@yourcompany.com"
      },
      {
        "IdentityProvider": "RAMP",
        "Username": "emergency",
        "Email": "emergency@yourcompany.com",
        "Password": "EmergencyAccess@123"
      }
    ]
  }
}

Use case: Primary access via OIDC, local admin for IdP outages.

Scenario 3: Multi-Environment

Development

appsettings.Development.json:

{
  "Bootstrap": {
    "Administrators": [
      {
        "IdentityProvider": "RAMP",
        "Username": "devadmin",
        "Email": "devadmin@localhost",
        "Password": "DevAdmin@123"
      }
    ]
  }
}

Production

appsettings.Production.json:

{
  "Bootstrap": {
    "Administrators": [
      {
        "IdentityProvider": "OIDC",
        "Username": "admin@yourcompany.com",
        "Email": "admin@yourcompany.com"
      }
    ]
  }
}

---

Frequently Asked Questions

Can I add users after initial setup?

Yes, but use the web UI (Admin -> Users) instead of bootstrap config. Bootstrap is only for initial setup.

What if I forget the bootstrap password?

Reset it in configuration and restart RAMP. Existing password will NOT be updated automatically — you’ll need to reset via database.

Can I remove bootstrap admins later?

Yes. Bootstrap-created users are regular users. Delete via Admin -> Users in the web UI.

Do bootstrap admins count toward license limits?

Yes. Bootstrap admins are regular user accounts and count toward any license limits (if applicable).

---

Next Steps

• RAMP Native Authentication — Configure username/password login
• MFA Setup — Enable multi-factor authentication
• Authentication Overview — Compare all authentication providers

---

Related topics

Authentication Overview Compare all authentication methods and choose the right one

Application Settings Reference Complete reference for RAMP's appsettings.json configuration

Roles Configure and manage application roles and permissions