### Display setup help Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_server_manually.md Shows all available setup options and examples for noninteractive installation. ```shell $ ./setup --help ``` -------------------------------- ### Interactive setup output for PingAuthorize Policy Editor Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_pe_interactive.md Example output from running the setup script interactively, showing the prompts and recommended answers for a Quickstart configuration. The output includes the license file location, port selections, host name, and backup schedule. ```text [/opt/{pingauthorize}-PAP]$ bin/setup Please enter the location of a valid {pingauthorize} with Symphonic license file [/opt/{pingauthorize}-PAP/{pingauthorize}.lic]: /opt/{pingauthorize}/{pingauthorize}.lic {pingauthorize} Policy Editor ============================================ How would you like to configure the Policy Editor? 1) Quickstart (DEMO PURPOSES ONLY): This option configures the server with a form based authentication and generates a self-signed server certificate 2) OpenID Connect: This option configures the server to use an OpenID Connect provider such as {pingfed} 3) Cancel the setup Enter option [1]: 1 On which port should the Policy Editor listen for application HTTPS communications? [9443]: 9443 Enter the fully qualified host name or IP address that users' browsers will use to connect to this GUI [centos.localdomain]: pap.examplecom On which port should the Policy Editor listen for administrative HTTPS communications? [9444]: 9444 Would you like to enable periodic policy database backups? (yes / no) [yes]: yes Enter the backup schedule as a cron expression (defaults to daily at midnight): [0 0 0 * * ?]: 0 0 0 * * ? Setup Summary ========================================== Host Name: pap.example.com Server Port: 9443 Secure Access: Self-signed certificate Admin Port: 9444 Periodic Backups: Enabled Backup Schedule: 0 0 0 * * ? ``` -------------------------------- ### Run setup interactively Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_server_manually.md Starts the interactive installation wizard for PingAuthorize Server. Run this command from the server installation directory. ```shell $ ./setup ``` -------------------------------- ### Run setup to change authentication mode (manual install) Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_change_pe_authn_mode.md Runs the setup tool to select a different authentication mode. This overwrites the existing configuration. ```shell $ bin/setup ``` -------------------------------- ### Setup summary and completion Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_config_authn_server_openid_connect.md Shows the setup summary and the command-line arguments that would set up the server non-interactively. Confirms setup completed successfully. ```bash Setup Summary ======================================= Host Name: pap.example.com Server Port: 9443 Secure Access: Self-signed certificate Admin Port: 9444 Periodic Backups: Enabled Backup Schedule: 0 0 0 * * ? Command-line arguments that would set up this server non-interactively: setup oidc --pkcs12KeyStorePath config/keystore.p12 --licenseKeyFile {pingauthorize}.lic \ --oidcHostname pf.example.com --oidcPort 9031 --certNickname server-cert --backupSchedule '0 0 0 * * ?' \ --hostname pap.example.com --port 9443 --generateSelfSignedCertificate --adminPort 9444 What would you like to do? 1) Set up the server with the parameters above 2) Provide the setup parameters again 3) Cancel the setup Enter option [1]: Setup completed successfully ``` -------------------------------- ### Start the Policy Editor (manual install) Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_change_pe_authn_mode.md Starts the PingAuthorize Policy Editor server after changing its authentication mode. ```shell $ bin/start-server ``` -------------------------------- ### Set database credentials with the setup tool Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_set_db_creds_startup.md Use the setup tool with the --dbAdminUsername, --dbAdminPassword, --dbAppUsername, and --dbAppPassword options to set policy database credentials. The example sets admin credentials to adminuser/Passw0rd and application credentials to appuser/S3cret, and includes the --interactive flag. ```bash bin/setup --dbAdminUsername adminuser \ --dbAdminPassword Passw0rd \ --dbAppUsername appuser \ --dbAppPassword S3cret \ --interactive ``` -------------------------------- ### Set up Policy Editor with PostgreSQL policy database Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_pe_noninteractive.md Runs `bin/setup demo` with a PostgreSQL database connection string and app credentials. The `--dbAppPassword` option persists the password to a configuration file; instead, omit it and set the `PING_DB_APP_PASSWORD` environment variable before server start. The example includes the recommended `env PING_DB_APP_PASSWORD= bin/start-server` command. ```shell $ bin/setup demo \ --dbConnectionString "jdbc:postgresql://:/" \ --dbAppUsername "" \ --dbAppPassword "" \ --generateSelfSignedCertificate \ --decisionPointSharedSecret pingauthorize \ --hostname \ --port \ --adminPort \ --licenseKeyFile ``` ```shell $ env PING_DB_APP_PASSWORD= bin/start-server ``` -------------------------------- ### Change database credentials from defaults Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_change_db_creds.md Runs setup with new admin and application credentials. This example changes from default credentials to admin/Passw0rd and app/S3cret. ```bash setup --dbAdminUsername admin \ --dbAdminPassword Passw0rd \ --dbAppUsername app \ --dbAppPassword S3cret \ --interactive ``` -------------------------------- ### Set environment variable and start server Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_use_env_vars.md Sets the TRUST_STORE_PASSWORD environment variable and starts the server. ```shell $ export TRUST_STORE_PASSWORD=password123; bin/start-server ``` -------------------------------- ### Run setup with --optionsFile Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_config_jwt_claims.md Runs `bin/setup demo` with the `--optionsFile my-options.yml` argument and other required options. Replace placeholders like ``, ``, ``, and `` with your values. ```shell $ bin/setup demo \ --adminUsername admin \ --generateSelfSignedCertificate \ --decisionPointSharedSecret pingauthorize \ --hostname \ --port \ --adminPort \ --licenseKeyFile \ --optionsFile my-options.yml ``` -------------------------------- ### Run setup with --optionsFile Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_config_key_store_pol_info.md Run setup using the --optionsFile argument to apply the key store configuration. Customize other options as needed. ```shell $ bin/setup demo \ --adminUsername admin \ --generateSelfSignedCertificate \ --decisionPointSharedSecret pingauthorize \ --hostname \ --port \ --adminPort \ --licenseKeyFile \ --optionsFile my-options.yml ``` -------------------------------- ### Disable HTTP caching persistently with --disableApiHttpCache Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_http_caching.md Run setup with the --disableApiHttpCache option to disable HTTP caching persistently. Caching remains disabled for future server starts and stops. The example includes other setup options such as --adminUsername, --generateSelfSignedCertificate, --decisionPointSharedSecret, --hostname, --port, and --adminPort. ```bash bin/setup demo \ --disableApiHttpCache \ --adminUsername admin \ --generateSelfSignedCertificate \ --decisionPointSharedSecret 2FederateM0re \ --hostname example.com \ --port 9443 \ --adminPort 9444 ``` -------------------------------- ### Noninteractive setup example Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_server_manually.md Installs PingAuthorize Server noninteractively with specified settings: LDAP port 8389, LDAPS port 8636, HTTPS port 8443, self-signed certificate, 1 GB JVM memory, instance name pingauthorize1, and location Austin. ```shell $ ./setup \ --cli --no-prompt --acceptLicense \ --licenseKeyFile \ --rootUserDN "cn=directory manager" \ --rootUserPassword \ --ldapPort 8389 --ldapsPort 8636 \ --httpsPort 8443 \ --generateSelfSignedCertificate \ --maxHeapSize 1g \ --instanceName pingauthorize1 \ --location Austin ``` -------------------------------- ### Run setup with --optionsFile Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_config_pe_database_services.md Command to run the setup script with the --optionsFile argument and customize other options as needed. ```shell $ bin/setup demo \ --adminUsername admin \ --generateSelfSignedCertificate \ --decisionPointSharedSecret pingauthorize \ --hostname \ --port \ --adminPort \ --licenseKeyFile \ --optionsFile my-options.yml ``` -------------------------------- ### CLI help options for setup tool Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_pe_noninteractive.md Commands to display help for the setup tool and its subcommands (demo and oidc modes). ```shell $ bin/setup --help ``` ```shell $ bin/setup demo --help ``` ```shell $ bin/setup oidc --help ``` -------------------------------- ### Unset JAVA_ARGS and UNBOUNDID_JAVA_ARGS Source: https://docs.pingidentity.com/pingauthorize/11.1/troubleshooting_pingauthorize_server/paz_server_will_not_run_setup.md If the setup tool fails because the JVM cannot start with the provided arguments, unset the JAVA_ARGS and UNBOUNDID_JAVA_ARGS environment variables before re-running setup. ```bash unset JAVA_ARGS UNBOUNDID_JAVA_ARGS ``` -------------------------------- ### Set up Policy Editor with custom SSL certificate Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_install_pe_noninteractive.md Runs `bin/setup demo` with a provided PKCS12 SSL certificate. The `KEYSTORE_PIN_FILE` environment variable provides the path to a file containing a valid key store PIN. The `--pkcs12KeyStorePath` is the path to a valid PKCS12 key store file, and `--certNickname` is the certificate nickname or alias. Only lowercase certificate nicknames are supported, and `KEYSTORE_PIN_FILE` must also be available in the environment of `start-server` because it is not persisted. ```shell $ env KEYSTORE_PIN_FILE= bin/setup demo --adminUsername admin \ --pkcs12KeyStorePath \ --certNickname \ --decisionPointSharedSecret \ --hostname \ --port \ --adminPort \ --licenseKeyFile ``` -------------------------------- ### SCIM GET request without correlation ID header Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_manage_http_corr_ids.md Example of a SCIM 2 GET request that does not include a correlation ID header. PingAuthorize generates a UUID and returns it in the response. ```http GET https://localhost:8443/scim/v2/Me HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Authorization: Bearer ... Connection: keep-alive Host: localhost:1443 User-Agent: HTTPie/0.9.9 ``` -------------------------------- ### Copy H2 policy database for upgrade (Step 8.0 earlier) Source: https://docs.pingidentity.com/pingauthorize/11.1/upgrading_pingauthorize/paz_manual_upgrades.md Copy the existing H2 policy database when upgrading from Step 8.0 earlier. This example assumes the old installation is in /opt/pingauthorize/PingAuthorize-PAP-previous and the new installation is in /opt/pingauthorize/PingAuthorize-PAP. ```shell $ cp /opt/pingauthorize/{pingauthorize}-PAP-previous/admin-point-application/db/Symphonic.mv.db opt/pingauthorize/{pingauthorize}-PAP ``` -------------------------------- ### Copy H2 policy database for upgrade (Step 8.1 and later) Source: https://docs.pingidentity.com/pingauthorize/11.1/upgrading_pingauthorize/paz_manual_upgrades.md Copy the existing H2 policy database when upgrading from Step 8.1 and later. This example assumes the old installation is in /opt/pingauthorize/PingAuthorize-PAP-previous and the new installation is in /opt/pingauthorize/PingAuthorize-PAP. ```shell $ cp /opt/pingauthorize/{pingauthorize}-PAP-previous/Symphonic.mv.db opt/pingauthorize/{pingauthorize}-PAP ``` -------------------------------- ### Run manage-profile setup Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_workflows.md Command to run the setup subcommand with the server profile and variables file. ```shell $ bin/manage-profile setup \ --profile ~/git/server-profiles/pingauthorize \ --profileVariablesFile ~/pingauthorize-variables-dev.env ``` -------------------------------- ### Run Policy Editor Setup with Options File Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_tf_attribute_cache_external.md Command to run the setup tool using a custom options file to apply the Redis configuration. ```shell $ bin/setup demo \ --adminUsername admin \ --generateSelfSignedCertificate \ --decisionPointSharedSecret pingauthorize \ --hostname \ --port \ --adminPort \ --licenseKeyFile \ --optionsFile my-options.yml ``` -------------------------------- ### Example access token request Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_policy_administration_guide/paz_step_up_auth.md Shows a GET request to /secrets with a Bearer token. The token includes claims such as acr and auth_time that are used for step-up authentication. ```http GET /secrets HTTP/1.1 Host: example.com Authorization: Bearer eyJ0eX... ``` -------------------------------- ### Run bin/setup to reconfigure the Policy Editor Source: https://docs.pingidentity.com/pingauthorize/11.1/installing_and_uninstalling_pingauthorize/paz_config_authn_server_openid_connect.md Re-runs bin/setup to reconfigure the application. Select option 2 for OpenID Connect and provide the hostname for the Policy Editor. ```bash [/opt/{pingauthorize}-PAP]$ bin/setup There is an existing configuration file at /config/configuration.yml. Overwrite? (yes / no) [no]: yes Detected valid license file in server root {pingauthorize}.lic {pingauthorize} Policy Editor ============================================ How would you like to configure the Policy Editor? 1) Quickstart (DEMO PURPOSES ONLY): This option configures the server with a form based authentication and generates a self-signed server certificate 2) OpenID Connect: This option configures the server to use an OpenID Connect provider such as PingFederate 3) Cancel the setup Enter option [1]: 2 On which port should the Policy Editor listen for HTTPS communications? [9443]: Enter the fully qualified host name or IP address that users' browsers will use to connect to this GUI [pap.example.com]: pap.example.com ``` -------------------------------- ### HTTP response with Correlation-Id header Source: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_manage_http_corr_ids.md Example response to the SCIM GET request, showing the server-generated correlation ID in the `Correlation-Id` header. The ellipsis indicates lines removed for brevity. ```http HTTP/1.1 200 OK Content-Length: 903 Content-Type: application/scim+json Correlation-Id: c52af735-788d-4798-be3b-8d1f3c8f9d64 Date: Mon, 15 Mar 2021 15:23:06 GMT Request-Id: 371 { "mail": [ "user.0@example.com" ], "initials": [ "AOR" ], "homePhone": [ "+1 295 940 2750" ], "pager": [ "+1 604 109 3407" ], "givenName": [ "Anett" ], ... } ```