We use a predefined
admin user in our web application.
The configured password is very long and different for each installation and we have implemented brute force mitigations.
What are the security concerns of having a predefined user?
You should insert this user into your database uniquely for each installation instead of hard coding the account or at least give the ability to disable the account as well as reset the accounts password. You cannot begin to predict how this backdoor admin account you are creating could be abused in the future. Maybe your company's sensitive files are breached including all your installation passwords and now you need to quickly disable the account. Maybe an attacker uncovers a vulnerability in your hardcoded admin account logic and suddenly you have no way to remove it. It's better to give yourself options in the case of a breach like a) ability to Delete account b) ability to disable account c) ability to rename account d) ability to reset password