PingAuthorize

https://docs.pingidentity.com/pingauthorize
Admin
PingAuthorize provides fine-grained, attribute-based access control and dynamic authorization...
Tokens:325,864
Snippets:2,560
Trust Score:9.9
Update:1 week ago
Show doc for...
Tokens:
Raw
### Display setup help

Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_server_manually.md

Shows all available setup options and examples for noninteractive installation.

```shell
$ ./setup --help
```

--------------------------------

### Interactive setup output for PingAuthorize Policy Editor

Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_pe_interactive.md

Example output from running the setup script interactively, showing the prompts and recommended answers for a Quickstart configuration. The output includes the license file location, port selections, host name, and backup schedule.

```text
[/opt/{pingauthorize}-PAP]$ bin/setup

Please enter the location of a valid  {pingauthorize}  with Symphonic license file
[/opt/{pingauthorize}-PAP/{pingauthorize}.lic]: /opt/{pingauthorize}/{pingauthorize}.lic

{pingauthorize}  Policy Editor
============================================

How would you like to configure the Policy Editor?

    1)  Quickstart (DEMO PURPOSES ONLY): This option configures the server with a form
        based authentication and generates a self-signed server certificate
    2)  OpenID Connect: This option configures the server to use an OpenID Connect
        provider such as  {pingfed}
    3)  Cancel the setup

Enter option [1]: 1

On which port should the Policy Editor listen for application HTTPS communications? [9443]: 9443

Enter the fully qualified host name or IP address that users' browsers will use to
connect to this GUI [centos.localdomain]: pap.examplecom

On which port should the Policy Editor listen for administrative HTTPS communications? [9444]: 9444

Would you like to enable periodic policy database backups? (yes / no) [yes]: yes

Enter the backup schedule as a cron expression (defaults to daily at midnight): [0 0 0 * * ?]: 0 0 0 * * ?

Setup Summary
==========================================
Host Name:         pap.example.com
Server Port:       9443
Secure Access:     Self-signed certificate
Admin Port:        9444
Periodic Backups:  Enabled
Backup Schedule:   0 0 0 * * ?
```

--------------------------------

### Run setup interactively

Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_server_manually.md

Starts the interactive installation wizard for PingAuthorize Server. Run this command from the server installation directory.

```shell
$ ./setup
```

--------------------------------

### Run setup to change authentication mode (manual install)

Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_change_pe_authn_mode.md

Runs the setup tool to select a different authentication mode. This overwrites the existing configuration.

```shell
$ bin/setup
```

--------------------------------

### Setup summary and completion

Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_config_authn_server_openid_connect.md

Shows the setup summary and the command-line arguments that would set up the server non-interactively. Confirms setup completed successfully.

```bash
   Setup Summary
=======================================
Host Name:        pap.example.com
Server Port:      9443
Secure Access:    Self-signed certificate
Admin Port:       9444
Periodic Backups: Enabled
Backup Schedule:  0 0 0 * * ?

Command-line arguments that would set up this server non-interactively:
    setup oidc --pkcs12KeyStorePath config/keystore.p12 --licenseKeyFile  {pingauthorize}.lic \
         --oidcHostname pf.example.com --oidcPort 9031 --certNickname server-cert --backupSchedule '0 0 0 * * ?' \
         --hostname pap.example.com --port 9443 --generateSelfSignedCertificate --adminPort 9444

What would you like to do?

    1)  Set up the server with the parameters above
    2)  Provide the setup parameters again
    3)  Cancel the setup

Enter option [1]:

Setup completed successfully
```

--------------------------------

### Start the Policy Editor (manual install)

Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_change_pe_authn_mode.md

Starts the PingAuthorize Policy Editor server after changing its authentication mode.

```shell
$ bin/start-server
```

--------------------------------

### Set database credentials with the setup tool

Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_set_db_creds_startup.md

Use the setup tool with the --dbAdminUsername, --dbAdminPassword, --dbAppUsername, and --dbAppPassword options to set policy database credentials. The example sets admin credentials to adminuser/Passw0rd and application credentials to appuser/S3cret, and includes the --interactive flag.

```bash
bin/setup --dbAdminUsername adminuser \
  --dbAdminPassword Passw0rd \
  --dbAppUsername appuser \
  --dbAppPassword S3cret \
  --interactive
```

--------------------------------

### Set up Policy Editor with PostgreSQL policy database

Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_pe_noninteractive.md

Runs `bin/setup demo` with a PostgreSQL database connection string and app credentials. The `--dbAppPassword` option persists the password to a configuration file; instead, omit it and set the `PING_DB_APP_PASSWORD` environment variable before server start. The example includes the recommended `env PING_DB_APP_PASSWORD=<db-password> bin/start-server` command.

```shell
$ bin/setup demo \
  --dbConnectionString "jdbc:postgresql://<host>:<port>/<database>" \
  --dbAppUsername "<db-user>" \
  --dbAppPassword "<db-password>" \
  --generateSelfSignedCertificate \
  --decisionPointSharedSecret pingauthorize \
  --hostname  <pap-hostname>  \
  --port  <pap-port>  \
  --adminPort  <admin-port>  \
  --licenseKeyFile  <path-to-license>
```

```shell
$ env PING_DB_APP_PASSWORD=<db-password>  bin/start-server
```

--------------------------------

### Change database credentials from defaults

Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_change_db_creds.md

Runs setup with new admin and application credentials. This example changes from default credentials to admin/Passw0rd and app/S3cret.

```bash
setup --dbAdminUsername admin \
  --dbAdminPassword Passw0rd \
  --dbAppUsername app \
  --dbAppPassword S3cret \
  --interactive
```

--------------------------------

### Set environment variable and start server

Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_use_env_vars.md

Sets the TRUST_STORE_PASSWORD environment variable and starts the server.

```shell
$ export TRUST_STORE_PASSWORD=password123; bin/start-server
```

--------------------------------

### Run setup with --optionsFile

Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_config_jwt_claims.md

Runs `bin/setup demo` with the `--optionsFile my-options.yml` argument and other required options. Replace placeholders like `<pap-hostname>`, `<pap-port>`, `<admin-port>`, and `<path-to-license>` with your values.

```shell
$ bin/setup demo \
  --adminUsername admin \
  --generateSelfSignedCertificate \
  --decisionPointSharedSecret pingauthorize \
  --hostname <pap-hostname>  \
  --port <pap-port>  \
  --adminPort <admin-port>  \
  --licenseKeyFile <path-to-license>  \
  --optionsFile my-options.yml
```

--------------------------------

### Run setup with --optionsFile

Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_config_key_store_pol_info.md

Run setup using the --optionsFile argument to apply the key store configuration. Customize other options as needed.

```shell
$ bin/setup demo \
  --adminUsername admin \
  --generateSelfSignedCertificate \
  --decisionPointSharedSecret pingauthorize \
  --hostname <pap-hostname> \
  --port <pap-port> \
  --adminPort  <admin-port>  \
  --licenseKeyFile <path-to-license> \
  --optionsFile my-options.yml
```

--------------------------------

### Disable HTTP caching persistently with --disableApiHttpCache

Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_http_caching.md

Run setup with the --disableApiHttpCache option to disable HTTP caching persistently. Caching remains disabled for future server starts and stops. The example includes other setup options such as --adminUsername, --generateSelfSignedCertificate, --decisionPointSharedSecret, --hostname, --port, and --adminPort.

```bash
bin/setup demo \
--disableApiHttpCache \
--adminUsername admin \
--generateSelfSignedCertificate \
--decisionPointSharedSecret 2FederateM0re \
--hostname example.com \
--port 9443 \
--adminPort 9444
```

--------------------------------

### Noninteractive setup example

Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_server_manually.md

Installs PingAuthorize Server noninteractively with specified settings: LDAP port 8389, LDAPS port 8636, HTTPS port 8443, self-signed certificate, 1 GB JVM memory, instance name pingauthorize1, and location Austin.

```shell
$ ./setup \
  --cli --no-prompt --acceptLicense \
  --licenseKeyFile  <path-to-license>  \
  --rootUserDN "cn=directory manager" \
  --rootUserPassword  <your-password>  \
  --ldapPort 8389 --ldapsPort 8636 \
  --httpsPort 8443 \
  --generateSelfSignedCertificate \
  --maxHeapSize 1g \
  --instanceName pingauthorize1 \
  --location Austin
```

--------------------------------

### Run setup with --optionsFile

Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_config_pe_database_services.md

Command to run the setup script with the --optionsFile argument and customize other options as needed.

```shell
$ bin/setup demo \
  --adminUsername admin \
  --generateSelfSignedCertificate \
  --decisionPointSharedSecret pingauthorize \
  --hostname  <pap-hostname>  \
  --port  <pap-port>  \
  --adminPort  <admin-port>  \
  --licenseKeyFile  <path-to-license>  \
  --optionsFile my-options.yml
```

--------------------------------

### CLI help options for setup tool

Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_pe_noninteractive.md

Commands to display help for the setup tool and its subcommands (demo and oidc modes).

```shell
$ bin/setup --help
```

```shell
$ bin/setup demo --help
```

```shell
$ bin/setup oidc --help
```

--------------------------------

### Unset JAVA_ARGS and UNBOUNDID_JAVA_ARGS

Source: https://docs.pingidentity.com/pingauthorize/11.1/troubleshooting_pingauthorize_server/paz_server_will_not_run_setup.md

If the setup tool fails because the JVM cannot start with the provided arguments, unset the JAVA_ARGS and UNBOUNDID_JAVA_ARGS environment variables before re-running setup.

```bash
unset JAVA_ARGS UNBOUNDID_JAVA_ARGS
```

--------------------------------

### Set up Policy Editor with custom SSL certificate

Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_pe_noninteractive.md

Runs `bin/setup demo` with a provided PKCS12 SSL certificate. The `KEYSTORE_PIN_FILE` environment variable provides the path to a file containing a valid key store PIN. The `--pkcs12KeyStorePath` is the path to a valid PKCS12 key store file, and `--certNickname` is the certificate nickname or alias. Only lowercase certificate nicknames are supported, and `KEYSTORE_PIN_FILE` must also be available in the environment of `start-server` because it is not persisted.

```shell
$ env KEYSTORE_PIN_FILE=<path-to-keystore.pin>  bin/setup demo
  --adminUsername admin \
  --pkcs12KeyStorePath  <path-to-keystore.p12>  \
  --certNickname  <certificate-nickname>  \
  --decisionPointSharedSecret  <shared-secret>  \
  --hostname  <pap-hostname>  \
  --port  <pap-port>  \
  --adminPort  <admin-port>  \
  --licenseKeyFile  <path-to-license>
```

--------------------------------

### SCIM GET request without correlation ID header

Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_manage_http_corr_ids.md

Example of a SCIM 2 GET request that does not include a correlation ID header. PingAuthorize generates a UUID and returns it in the response.

```http
GET https://localhost:8443/scim/v2/Me HTTP/1.1
Accept: /
Accept-Encoding: gzip, deflate
Authorization: Bearer ...
Connection: keep-alive
Host: localhost:1443
User-Agent: HTTPie/0.9.9
```

--------------------------------

### Copy H2 policy database for upgrade (Step 8.0 earlier)

Source: https://docs.pingidentity.com/pingauthorize/11.1/upgrading_pingauthorize/paz_manual_upgrades.md

Copy the existing H2 policy database when upgrading from Step 8.0 earlier. This example assumes the old installation is in /opt/pingauthorize/PingAuthorize-PAP-previous and the new installation is in /opt/pingauthorize/PingAuthorize-PAP.

```shell
$ cp /opt/pingauthorize/{pingauthorize}-PAP-previous/admin-point-application/db/Symphonic.mv.db opt/pingauthorize/{pingauthorize}-PAP
```

--------------------------------

### Copy H2 policy database for upgrade (Step 8.1 and later)

Source: https://docs.pingidentity.com/pingauthorize/11.1/upgrading_pingauthorize/paz_manual_upgrades.md

Copy the existing H2 policy database when upgrading from Step 8.1 and later. This example assumes the old installation is in /opt/pingauthorize/PingAuthorize-PAP-previous and the new installation is in /opt/pingauthorize/PingAuthorize-PAP.

```shell
$ cp /opt/pingauthorize/{pingauthorize}-PAP-previous/Symphonic.mv.db opt/pingauthorize/{pingauthorize}-PAP
```

--------------------------------

### Run manage-profile setup

Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_workflows.md

Command to run the setup subcommand with the server profile and variables file.

```shell
$ bin/manage-profile setup \
  --profile ~/git/server-profiles/pingauthorize \
  --profileVariablesFile ~/pingauthorize-variables-dev.env
```

--------------------------------

### Run Policy Editor Setup with Options File

Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_tf_attribute_cache_external.md

Command to run the setup tool using a custom options file to apply the Redis configuration.

```shell
$ bin/setup demo \
  --adminUsername admin \
  --generateSelfSignedCertificate \
  --decisionPointSharedSecret pingauthorize \
  --hostname  <pap-hostname>  \
  --port <pap-port>  \
  --adminPort <admin-port>  \
  --licenseKeyFile <path-to-license>  \
  --optionsFile my-options.yml
```

--------------------------------

### Example access token request

Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_policy_administration_guide/paz_step_up_auth.md

Shows a GET request to /secrets with a Bearer token. The token includes claims such as acr and auth_time that are used for step-up authentication.

```http
GET /secrets HTTP/1.1
Host: example.com
Authorization: Bearer eyJ0eX...
```

--------------------------------

### Run bin/setup to reconfigure the Policy Editor

Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_config_authn_server_openid_connect.md

Re-runs bin/setup to reconfigure the application. Select option 2 for OpenID Connect and provide the hostname for the Policy Editor.

```bash
[/opt/{pingauthorize}-PAP]$ bin/setup

There is an existing configuration file at /config/configuration.yml. Overwrite? (yes /
no) [no]: yes
Detected valid license file in server root  {pingauthorize}.lic

 {pingauthorize}  Policy Editor
============================================

How would you like to configure the Policy Editor?

    1)  Quickstart (DEMO PURPOSES ONLY): This option configures the server with a form based authentication and
        generates a self-signed server certificate
    2)  OpenID Connect: This option configures the server to use an OpenID Connect provider such as PingFederate
    3)  Cancel the setup

Enter option [1]:  2

On which port should the Policy Editor listen for HTTPS communications? [9443]:

Enter the fully qualified host name or IP address that users' browsers will use to connect to this GUI [pap.example.com]: pap.example.com
```

--------------------------------

### HTTP response with Correlation-Id header

Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_manage_http_corr_ids.md

Example response to the SCIM GET request, showing the server-generated correlation ID in the `Correlation-Id` header. The ellipsis indicates lines removed for brevity.

```http
HTTP/1.1 200 OK
Content-Length: 903
Content-Type: application/scim+json
Correlation-Id: c52af735-788d-4798-be3b-8d1f3c8f9d64
Date: Mon, 15 Mar 2021 15:23:06 GMT
Request-Id: 371

{
    "mail": [
        "user.0@example.com"
    ],
    "initials": [
        "AOR"
    ],
    "homePhone": [
        "+1 295 940 2750"
    ],
    "pager": [
        "+1 604 109 3407"
    ],
    "givenName": [
        "Anett"
    ],
   ...
}
```
Tokens:
Raw