SONAR-14175 Update doc about admin password reset

* SONAR-14175 Add upgrade note about default admin credentials usage
* SONAR-14175 Update docs to set reset_password to true in the resetting admin password SQL

diff --git a/server/sonar-docs/src/pages/instance-administration/security.md b/server/sonar-docs/src/pages/instance-administration/security.md
index 012be7ea82edaa0c1c9b3fb6ef8c785c90810d0e..429797767d025459dd3715f9952240b0355b8033 100644 (file)
--- a/server/sonar-docs/src/pages/instance-administration/security.md
+++ b/server/sonar-docs/src/pages/instance-administration/security.md
@@ -94,7 +94,7 @@ When installing SonarQube, a default user with Administer System permission is c
 ## Reinstating Admin Access
 If you changed and then lost the `admin` password, you can reset it using the following query:
 ```
-update users set crypted_password = '$2a$12$uCkkXmhW5ThVK8mpBvnXOOJRLd64LJeHTeCkSuB3lfaR2N0AYBaSi', salt=null, hash_method='BCRYPT' where login = 'admin'
+update users set crypted_password = '$2a$12$uCkkXmhW5ThVK8mpBvnXOOJRLd64LJeHTeCkSuB3lfaR2N0AYBaSi', salt=null, hash_method='BCRYPT', reset_password=true where login = 'admin'
 ```
 If you've deleted `admin` and subsequently locked out the other users with global administrative permissions, you'll need to re-grant `admin` to a user with the following query:
 ```

diff --git a/server/sonar-docs/src/pages/setup/upgrade-notes.md b/server/sonar-docs/src/pages/setup/upgrade-notes.md
index a0fa147519adda4796bce2649144ba0665756356..f99c961049f33ed187d8bfcb993dc39d71e2fddf 100644 (file)
--- a/server/sonar-docs/src/pages/setup/upgrade-notes.md
+++ b/server/sonar-docs/src/pages/setup/upgrade-notes.md
@@ -10,6 +10,9 @@ When running a cluster with Data Center Edition, the configuration of search nod
 
 We recommend only giving external access to the application nodes and to the main port. ([SONAR-12686](https://jira.sonarsource.com/browse/SONAR-12686)).
 
+**Default Authentication and Administrator credentials**  
+On a fresh install, to avoid mis-configuration and related security risks, you now have by default to authenticate and to update the password for the Administrator account. When upgrading, if your were still using default credentials, you'll be asked to change the password the next time you authenticate with the admin account. ([MMF-1352](https://jira.sonarsource.com/browse/MMF-2146), [MMF-1352](https://jira.sonarsource.com/browse/MMF-1352)).
+
 [Full release notes](https://jira.sonarsource.com/secure/ReleaseNote.jspa?projectId=10930&version=16435)  
 
 ## Release 8.5 Upgrade Notes