cmd: introduce FORCE_ROOT_CLIENT_CREDENTIALS env var

closes #140

cmd/host.go

@@ -43,6 +43,11 @@ This command supports the following environment variables:
 - SYSTEM_SECRET: A secret that is at least 16 characters long. If none is provided, one will be generated. They key
 	is used to encrypt sensitive data using AES-GCM (256 bit) and validate HMAC signatures.
 
+- FORCE_ROOT_CLIENT_CREDENTIALS: On first start up, Hydra generates a root client with random id and secret. Use
+	this environment variable in the form of "FORCE_ROOT_CLIENT_CREDENTIALS=id:secret" to set
+	the client id and secret yourself.
+
+
 - HTTPS_TLS_CERT_PATH: The path to the TLS certificate (pem encoded).
 - HTTPS_TLS_KEY_PATH: The path to the TLS private key (pem encoded).
 - HTTPS_TLS_CERT: A pem encoded TLS certificate passed as string. Can be used instead of HTTPS_TLS_CERT_PATH.

cmd/server/handler.go

@@ -14,6 +14,8 @@ import (
 	"github.com/ory-am/hydra/policy"
 	"github.com/ory-am/hydra/warden"
 	"github.com/ory-am/ladon"
+	"os"
+	"strings"
 )
 
 type Handler struct {
@@ -86,8 +88,21 @@ func (h *Handler) createRootIfNewInstall(c *config.Config) {
 	pkg.Must(err, "Could notgenerate secret because %s", err)
 	secret := string(rs)
 
+	id := ""
+	forceRoot := os.Getenv("FORCE_ROOT_CLIENT_CREDENTIALS")
+	if forceRoot != "" {
+		credentials := strings.Split(forceRoot, ":")
+		if len(credentials) == 2 {
+			id = credentials[0]
+			secret = credentials[1]
+		} else {
+			logrus.Warnln("You passed malformed root client credentials, falling back to random values.")
+		}
+	}
+
 	logrus.Warn("No clients were found. Creating a temporary root client...")
 	root := &client.Client{
+		ID: id,
 		Name:          "This temporary client is generated by hydra and is granted all of hydra's administrative privileges. It must be removed when everything is set up.",
 		ResponseTypes: []string{"id_token", "code", "token"},
 		GrantTypes:    []string{"implicit", "refresh_token", "authorization_code", "password", "client_credentials"},