Bootstrapping the first administrator

Procedure

Set JANUS_BOOTSTRAP_ADMIN_EMAILS to a comma-separated list before first start. Any listed address is granted the admin role when it signs in — on first sign-in, or on the next one if the account already exists.

Once a real administrator exists you can unset the variable and restart: roles are stored in the database and persist. Further promotions happen in Administration → People.

Alternatively, JANUS_ADMIN_GROUPS grants the admin capability to members of the listed identity-provider groups (comma- or space-separated names, matched case-insensitively against the groups the person signs in with — the JANUS_OIDC_GROUPS_CLAIM claim, an added provider’s groups claim, or directory groups — on every sign-in). Unlike the bootstrap list this grant is not sticky: leaving the group, or unsetting the variable, revokes it at the next sign-in, while bootstrap- and UI-granted admin persist.

Removing an administrator group, or removing someone from an admin group (in Janus or through SCIM), takes group-granted administrator access away at once; so does changing an identity provider’s or the directory’s admin groups. Explicit and bootstrap administrators keep it. A person who leaves a group only in the identity provider keeps group-granted access until their next sign-in, because Janus learns those groups at sign-in.

Administrator groups can also be managed without a redeploy under Administration → People → Groups → Administrator groups, and per identity provider or directory (Admin groups). All of them combine with JANUS_ADMIN_GROUPS and are re-checked at every sign-in, and again whenever one of these lists or a group’s membership changes in Janus.

Guard rail

Janus refuses to demote or disable the last active administrator, so a deployment can never be locked out of its own admin console.