Admin user creation does not work

[oazabir]

Ran:

microk8s kubectl exec -n ess -it deploy/ess-matrix-authentication-service -- mas-cli manage register-user --yes --password 'Chat2025!'  --admin admin"

Output:

              Username: admin
             Matrix ID: @admin:kahf.co.uk
...

Ran

microk8s kubectl exec -n ess deploy/ess-matrix-authentication-service -- mas-cli manage promote-admin admin

Output:

2025-11-23T20:08:57.718456Z  INFO mas_cli::commands::manage:349 User promoted to admin user.id=01KAS5AT81BZ51V2K8TEC31WPK user.username=admin

But still login using admin / Chat2025! does not work. Says "Invalid credentials".

Tried different password combination. Tried deleting the admin user and creating again. No luck.

[oazabir]

Logs show

  WARN mas_handlers::views::login:282 - Failed to verify/upgrade password for user username="admin"

[oazabir]

1. register-user created password entry 1
2. set-password created password entry 2 (instead of replacing 1)
3. Result: User had 2 conflicting password hashes in the database

The authentication system was checking against the wrong/old password hash, causing all login attempts to
fail.

kubectl exec -n ess deploy/ess-matrix-authentication-service -- mas-cli timeout:
manage set-password --ignore-complexity admin "TestPass123"

This creates two password entries. Deleting one of them helps get passed the invalid credentials problem.

[oazabir]

Sign into Element does not work. Synapse does not have the user added.

SELECT name, admin, creation_ts FROM users WHERE na…

Running this on synapse returns 0 rows.

[benbz]

I'm not able to reproduce this:

$ helm upgrade -i -n ess ess charts/matrix-stack -f charts/matrix-stack/ci/example-default-enabled-components-values.yaml -f charts/matrix-stack/ci/test-cluster-mixin.yaml
Release "ess" does not exist. Installing it now.
I1124 13:33:37.340662  869522 warnings.go:110] "Warning: spec.SessionAffinity is ignored for headless services"
I1124 13:33:37.341891  869522 warnings.go:110] "Warning: spec.SessionAffinity is ignored for headless services"
NAME: ess
LAST DEPLOYED: Mon Nov 24 13:33:18 2025
NAMESPACE: ess
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
ESS Community 25.11.2-dev

You are using ESS Community which is tailored to small-/mid-scale, non-commercial community use cases. If you're looking for a professional Matrix backend that is designed to support enterprise requirements and certifications, take a look at ESS Pro https://element.io/server-suite.

ESS Pro provides Long-Term Support releases, automatic scaling (horizontal and vertical) of Synapse Workers, Advanced Identity Management to manage users and spaces permissions, and more.

Feel free to join our matrix room to discuss at https://matrix.to/#/#ess-community:element.io.
Your admin console is available at: https://admin.ess.localhost

To create your first user, please run the following command:
kubectl exec -n ess -it deployment/ess-matrix-authentication-service -- mas-cli manage register-user

Your chat client is available at: https://element.ess.localhost

You can manage your account at: https://mas.ess.localhost

To successfully federate, make sure that the Well-Known Delegation works properly using the matrix-federation-tester: https://federationtester.matrix.org/#ess.localhost

$ kubectl exec -it -n ess deploy/ess-matrix-authentication-service -- mas-cli manage register-user --yes --password 'Chat2025!' --admin admin
Defaulted container "matrix-authentication-service" out of: matrix-authentication-service, render-config (init), db-wait (init), database-migrate (init)
User attributes
         Username: admin
        Matrix ID: @admin:ess.localhost
         Password: ********
No email address provided, user will be prompted to add one
Can request admin: true
2025-11-24T13:34:24.665101Z  WARN mas_cli::commands::manage:907 No email address provided, user will need to add one
2025-11-24T13:34:24.671450Z  INFO mas_cli::commands::manage:924 User registered user.id=01KAV157CSNCDQS8H1MCP00EPS

$ kubectl exec -it -n ess deploy/ess-matrix-authentication-service -- mas-cli manage promote-admin admin                                     
Defaulted container "matrix-authentication-service" out of: matrix-authentication-service, render-config (init), db-wait (init), database-migrate (init)
2025-11-24T13:34:28.213659Z  INFO mas_cli::commands::manage:349 User promoted to admin user.id=01KAV157CSNCDQS8H1MCP00EPS user.username=admin

I'm then able to login with admin / Chat2025!.

The only difference with what you're doing that I can see is you have a trailing " on the registration command. I expect that's some sort of copy/paste error into this GitHub issue as you've been able to promote the issue to admin and so the user was registered without a ".

I'm transferring this to the Matrix Authentication Service repo given there doesn't seem to be an ESS Community issue here and for the 2 different password entries comment.