Admin credentials required to add admin credential

[mgatt-v]

Hello,
I'm trying to create a SCEP provisioner in a step-ca environment on docker.
After changing the default certificates chain from ECDSA to RSA I tried to create the provisioner using step from the container itself:

step ca provisioner add <my_provisoner_name> --type SCEP --challenge <my_challenge> --encryption-algorithm-identifier 2

but I am asked to enter some admin credentials:

No admin credentials found. You must login to execute admin commands.
✗ Please enter admin name/subject (e.g., name@example.com): 

I read there is some admins and super Admins required to manage the provider but I got lost there (sorry I'm very beginner)
In my installation there is just one (by default I suppose) provisioner JWK only "out of the box".
To add a SCEP provider do Ineed to add an "Admin SCEP"?
What admin credential do I have to use creating this new admin?

Thanks

[hslatman]

You'll have to use the admin provisioner (your existing, first JWK provisioner), and step as the username. It will then request the JWK password. After that, the new provisioner should be added.

[mgatt-v]

Hello @hslatman
I don't know the JWK password. I didn't set in any place during the container startup.
Reading from https://smallstep.com/docs/step-ca/provisioners/#remote-provisioner-management I found;

When step-ca starts up, it will:

    Migrate the provisioners from your ca.json to the database

    Repurpose the first JWK provisioner in your ca.json as an administrative provisioner. If no JWK provisioner exists, it will add a [JWK](https://smallstep.com/docs/step-ca/provisioners/#jwk) provisioner called Admin JWK to the database. You will be prompted for a password that will encrypt the new provisioner key.

Using the Docker container I already found the database files so I suppose that the provisioners are already migated to database

Where or How can I do to set/recover that password using my Docker container image?

Thanks

[hslatman]

You did set (or let step generate) a password during initialization. That's the one you need.

[mgatt-v]

I started from scratch the container and I found in the logs:

...
👉 Your CA administrative username is: step
👉 Your CA administrative password is: <omissis>
🤫 This will only be displayed once. 
...

I missed this before!
I suspect to have found the password I need :)
Using docker container I'm bout to say that the risk missing this info is very high.

I did expect that I could se the password via any environment variable but It looks that it is possible set just the admin name using DOCKER_STEPCA_INIT_PROVISIONER_NAME

On Monday, I will run some tests to see if it works this way.