/
How to Create Control Center Users in HiveMQ

How to Create Control Center Users in HiveMQ

Overview

This article provides step-by-step instructions for creating Control Center users in HiveMQ production environments, particularly when using the Enterprise Security Extension (ESE).

Issue Description

When the HiveMQ Enterprise Security Extension is enabled, the default Control Center credentials (username: admin, password: hivemq) will not work(1)(https://community.hivemq.com/t/cannot-log-into-control-center-using-default-username-and-password/3619). Users need to create specific Control Center users and roles in the database to enable access.

Prerequisites

  • HiveMQ Enterprise Security Extension installed

  • Access to the database configured for ESE (e.g., PostgreSQL)

  • HiveMQ ESE Helper Tool available in the extensions helper subfolder

Solution Steps

Step 1: Locate the ESE Helper Tool

The ESE Helper Tool is located in the extensions helper subfolder(2)(https://docs.hivemq.com/hivemq-enterprise-security-extension/latest/helper.html):

hivemq-enterprise-security-extension/helper/

Step 2: Create Control Center User

Use the db create control-center-user command to generate SQL INSERT statements(2)(https://docs.hivemq.com/hivemq-enterprise-security-extension/latest/helper.html).

Interactive Mode (Recommended for Security):

./hivemq-ese-helper db create control-center-user my_user -p

The tool will prompt you to enter the password securely without recording it in shell history(2)(https://docs.hivemq.com/hivemq-enterprise-security-extension/latest/helper.html).

With Arguments:

./hivemq-ese-helper db create control-center-user my_user my_secret_password

Step 3: Execute the Generated SQL Statement

The helper tool generates an INSERT statement similar to(2)(https://docs.hivemq.com/hivemq-enterprise-security-extension/latest/helper.html):

INSERT INTO cc_users (username, password, password_iterations, password_salt, algorithm) VALUES ('my_user', 'bSdf47hY52qPBShvJE+mgcGtuQyveNdGWtO11BSm6l6Bp6cicW3ulb9GYaVTxCLyuIbzOgb5VM6KysxXhNgGrA==', 100, 'IThEd9r1+ALx/d++tdcOmw==', 'SHA512');

Execute this statement in your database.

Step 4: Configure ESE for Control Center Access

Ensure your ESE configuration(roles and permissions) is correctly set up for Control Centre access control (1) (https://community.hivemq.com/t/cannot-log-into-control-centre-using-default-username-and-password/3619).

Step 5: Verify Access

Navigate to the Control Center URL (default: http://localhost:8080/) and log in with the newly created credentials(3)(https://docs.hivemq.com/hivemq/4.28/control-center/index.html).

Additional Options

The helper tool supports various configuration options(2)(https://docs.hivemq.com/hivemq-enterprise-security-extension/latest/helper.html):

  • -a, --algorithm: Specify hashing algorithm (PLAIN, MD5, SHA512, BCRYPT, PKCS5S2, ARGON2ID_<memory>KB). Default: SHA512

  • -i, --iterations: Number of iterations for the algorithm. Default: 100

  • -s, --salt: Specify a custom Base64 encoded salt

  • -f, --file: Use a CSV file for bulk user creation

Prevention and Best Practices

  1. Always use the interactive mode (-p without value) to avoid storing passwords in shell history

  2. Use strong hashing algorithms like SHA512 for production environments

  3. Maintain proper database backups before executing user management operations

Related Resources