PingDirectory

https://docs.pingidentity.com/pingdirectory/
Admin
PingDirectory is a high-performance LDAP directory server and identity data store that provides...
Tokens:504,821
Snippets:7,690
Trust Score:9.9
Update:3 months ago
Show doc for...
Tokens:
Raw
### Run setup tool

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_install_first_dps.md

Executes the setup tool to install the proxy server, with options for SSL/TLS or standard installation.

```bash
root@proxy-east01: ./setup --no-prompt --acceptLicense \
--ldapPort 389 --rootUserPassword pass \
--maxHeapSize 1g --enableStartTLS --ldapsPort 636 \
--useJavaKeystore config/ExampleKeystore.jks \
--keyStorePasswordFile config/ExampleKeystore.pin \
--certNickname server-cert \
--useJavaTrustStore config/ExampleTruststore.jks
```

```bash
root@proxy-east01: ./setup --no-prompt --acceptLicense \
--ldapPort 389 --rootUserPassword pass --maxHeapSize 1g
```

--------------------------------

### Interactive setup prompts

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_config_ldap_ext_servers.md

Example output showing the interactive prompts for trusting certificates and creating the proxy user account.

```text
Testing connection to ds-east-01.example.com:1636 .....

Do you wish to trust the following certificate?

Certificate Subject: CN=ds-east-01.example.com, O=Example Self-Signed Certificate
Issuer Subject:      CN=ds-east-01.example.com, O=Example Self-Signed Certificate
Validity:            Thu May 21 08:02:30 CDT 2009 to Wed May 16 08:02:30 CDT 2029

Enter 'y' to trust the certificate or 'n' to reject it.

y

The certificate was added to the local trust store

Done
Testing 'cn=Proxy User' access to ds-east-01.example.com:1636 ..... Failed to bind as
'cn=Proxy User'

Would you like to create or modify root user 'cn=Proxy User' so that it's available
for this Directory Proxy Server? (yes / no) [yes]:

Enter the DN of an account on ds-east-01.example.com:1636 with which to create or
manage the 'cn=Proxy User' account [cn=Directory Manager]:

Enter the password for 'cn=Directory Manager':

Created 'cn=Proxy User,cn=Root DNs,cn=config'

Testing 'cn=Proxy User' privileges ..... Done
```

--------------------------------

### Install First PingDirectoryProxy Server

Source: https://docs.pingidentity.com/pingdirectory/11.1/installing_the_pingdirectory_suite_of_products/pd_proxy_install_dir_proxy_server.md

Execute the setup command with the --no-prompt flag to perform a non-interactive installation of the initial server instance.

```bash
$ env JAVA_HOME=/ds/java ./setup --no-prompt \
--rootUserDN "cn=Directory Manager" \
--rootUserPassword "password" --ldapPort 389 \
--acceptLicense \
--instanceName ds1 --location Denver
```

--------------------------------

### Run the Delegated Admin setup script

Source: https://docs.pingidentity.com/pingdirectory/11.1/installing_the_pingdirectory_suite_of_products/pd_da_install_application.md

Execute the setup script within the delegator directory to begin the installation process.

```shell
$ ./set-up-delegator.sh
```

--------------------------------

### Configure PKCS #11 during setup

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_security_guide/pd_sec_use_pkcs11_server.md

Example command for initializing the PingDirectory server with PKCS #11 keystore support enabled.

```shell
$ ./setup \
     --no-prompt \
     --noPropertiesFile \
     --acceptLicense \
     --localHostName demo.example.com \
     --ldapPort 1389 \
     --ldapsPort 1636 \
     --httpsPort 1443 \
     --usePKCS11KeyStore \
     --pkcs11ProviderConfigFile config/path/to/provider.conf \
     --keyStorePasswordFile /path/to/pkcs11/user.pin \
     --encryptDataWithPassphraseFromFile config/encryption-settings.pin \
     --baseDN dc=example,dc=com \
     --rootUserDN "cn=Directory Manager" \
     --rootUserPasswordFile config/pre-encoded-root-user-password.txt \
     --instanceName demo-instance \
     --location demo-location

Ping Identity Directory Server 8.3.0.0

Initializing ..... Done
Configuring Directory Server .....

Server tools will be configured with a minimal heap size due to limited system memory
available. If out of memory errors occur, it will be necessary to increase tool memory
settings in java.properties and run dsjavaproperties for the changes to take effect.

Configuring Directory Server ..... Done
Configuring Certificates ..... Done
Starting Directory Server ..... Done

Access product documentation from docs/index.html
```

--------------------------------

### Install the first PingDirectory server

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_deploy_basic_replication_topology.md

Installs the initial server with sample data.

```shell
$ ./setup --acceptLicense --baseDN "dc=example,dc=com" --ldapPort 1389 \
  --rootUserPassword pass --sampleData 2000 --no-prompt
```

--------------------------------

### Install Failover Server Non-interactively

Source: https://docs.pingidentity.com/pingdirectory/11.1/installing_the_pingdirectory_suite_of_products/pd_sync_installing_pds.md

Run the setup command to configure the secondary server to connect to the primary instance.

```shell
$ ./setup --localHostName <server2>.example.com --ldapPort 7389 \
  --masterHostName <server1>.example.com --masterPort 8389 \
  --masterUseNoSecurity \
  --acceptLicense \
  --rootUserPassword password \
  --no-prompt
```

--------------------------------

### Install PingDirectory Server in Non-Interactive Mode

Source: https://docs.pingidentity.com/pingdirectory/11.1/installing_the_pingdirectory_suite_of_products/pd_ds_install_server.md

Executes the setup command with required parameters to install the server without user prompts.

```shell
$ ./setup --no-prompt --rootUserPassword "password" \
  --baseDN "dc=example,dc=com" --acceptLicense --ldapPort 389 \
  --instancename Instance1 --location Location1
```

--------------------------------

### Interactive setup TLS configuration

Source: https://docs.pingidentity.com/pingdirectory/11.1/managing_servers_and_certificates/pd_ds_enable_tls_support_during_setup.md

Example of the interactive prompts provided by the setup tool to configure HTTPS, LDAPS, StartTLS, and certificate/truststore options.

```text
Do you want to enable the Directory Server services (Available State,
Available or Degraded State, Configuration, Consent, Directory REST API,
Documentation, and SCIM2) and Administrative Console over
HTTPS?  After setup, you can selectively enable or disable individual
services and applications by configuring the HTTPS Connection Handler
(yes / no) [yes]: yes

On which port should the Directory Server accept connections from HTTPS
clients? [443]: 443

On which port should the Directory Server accept connections from LDAP
clients? [389]: 389

Do you want to enable LDAPS? (yes / no) [yes]: yes
On which port should the Directory Server accept connections from LDAPS
clients? [636]: 636

Do you want to enable StartTLS? (yes / no) [yes]: yes

Certificate server options:

    1)  Generate self-signed certificate (recommended for testing purposes
        only)
    2)  Use an existing certificate located on a Java Keystore (JKS)
    3)  Use an existing certificate located on a PKCS12 keystore
    4)  Use an existing certificate on a PKCS11 token

Enter option [1]: 2

Java Keystore (JKS) path: /ca/ds1-keystore
Keystore PIN: {password}

Truststore options:

    1)  Generate a default JKS truststore
    2)  Use an existing JKS truststore
    3)  Use an existing PKCS12 truststore

Enter option [1]: 2

JKS truststore path: /ca/truststore
Truststore password (can be blank): {password}
```

--------------------------------

### Execute the setup command

Source: https://docs.pingidentity.com/pingdirectory/11.1/installing_the_pingdirectory_suite_of_products/pd_sync_installing_pds.md

Run the interactive setup script to begin the server configuration process.

```shell
$ ./setup
```

--------------------------------

### Run setup in non-interactive mode

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_installing_dir_proxy_server.md

Executes the setup script with predefined configuration flags to install the proxy server without manual prompts.

```bash
root@austin-proxy1: ./setup --acceptLicense \
--listenAddress austin-proxy1.example.com \
--ldapPort 389 --rootUserDN "cn=Directory Manager" \
--rootUserPassword pass --entryBalancing \
--maxHeapSize 2g --no-prompt
```

--------------------------------

### Interactive Topology Join Configuration

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_join_dps_existing_ds_topology.md

Example of the interactive setup prompts when joining a PingDirectory server topology instead of a proxy topology.

```text
Do you accept the terms of this license agreement?  Enter 'yes' to accept,
'no' to reject, or press ENTER to display the next page of the agreement []: yes

Would you like to add this server to an existing Directory Proxy Server
topology? (yes / no) [no]: no

Would you like to add this server to an existing PingDirectory server topology
to enable automatic backend server discovery? (yes / no) [no]: yes

Enter the host name of a PingDirectory server instance in the topology to
join. [proxy1.example.com]: ds1.example.com

Enter the LDAP port of a PingDirectory server instance in the topology to join
[389]: 636

How would you like to secure communication with the PingDirectory server

    1)  None
    2)  SSL
    3)  StartTLS

Enter option [1]: 2

Enter the DN used to bind to a PingDirectory server instance in the topology
to join [cn=Directory Manager]: cn=Directory Manager

Enter the password for cn=Directory Manager:
Testing connection to the existing PingDirectory server topology
The server presented the following certificate chain:

     Subject: CN=ds1.example.com,O=Example Corp,C=US
     Valid From: Saturday, November 2, 2019 at 10:44:26 PM CDT
     Valid Until: Sunday, November 1, 2020 at 09:44:26 PM CST
     SHA-1 Fingerprint: e1:4a:9e:dc:55:e8:40:78:9b:e1:1b:bd:3e:4c:85:fb:60:b4:27:35
     256-bit SHA-2 Fingerprint: 6e:92:c7:d6:66:c8:3d:2d:04:4c:f2:6a:cb:cb:51:5a:bf:f8:d6:18:0a:fc:64:d9:76:f4:4e:58:eb:c0:b8:b7
     -
     Issuer 1 Subject: CN=Example Certification Authority,O=Example Corp,C=US
     Valid From: Saturday, November 2, 2019 at 10:44:23 PM CDT
     Valid Until: Friday, October 28, 2039 at 10:44:23 PM CDT
     SHA-1 Fingerprint: 9a:b7:aa:a3:33:49:ce:b8:f3:7e:60:13:e0:3c:63:4b:8f:95:7a:f3
     256-bit SHA-2 Fingerprint: 04:07:86:f2:5c:e2:c1:88:fe:08:27:c1:1e:52:b0:4b:98:6e:a8:5c:85:fc:e0:d9:25:4f:07:ae:d7:0d:43:ba

Do you wish to trust this certificate?  Enter 'y' or 'n': y
Successfully connected to the existing PingDirectory server topology
```

--------------------------------

### Install Additional PingDirectoryProxy Server

Source: https://docs.pingidentity.com/pingdirectory/11.1/installing_the_pingdirectory_suite_of_products/pd_proxy_install_dir_proxy_server.md

Use the setup command with the --no-prompt flag and peer configuration options to add a new server to an existing deployment.

```bash
$ env JAVA_HOME=/ds/java ./setup --no-prompt \
--rootUserDN "cn=Directory Manager" \
--rootUserPassword "password" --ldapPort 1389 \
--localHostName proxy2.example.com \
--peerHostName proxy1.example.com --peerPort 389 \
--peerUseNoSecurity --acceptLicense --instanceName ds1 \
--location austin1
```

--------------------------------

### Run dsreplication using the interactive command line

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_use_restricted_arg_dsreplication_tool.md

Example of the interactive prompts when configuring entry balancing during the replication setup process.

```text
You must choose at least one base DN to be replicated.

Replicate base DN dc=example,dc=com? (yes / no) [yes]: yes

Replicate base DN ou=people,dc=example,dc=com? (yes / no) [yes]: yes

Do you plan to configure entry balancing using the Directory Proxy Server? (yes / no) [no]: yes

Is dc=example,dc=com an entry-balancing point? (yes / no) [no]: no

Is ou=people,dc=example,dc=com an entry-balancing point? (yes / no) [no]: yes
```

--------------------------------

### Configure PingDirectory with TLS in non-interactive mode

Source: https://docs.pingidentity.com/pingdirectory/11.1/managing_servers_and_certificates/pd_ds_enable_tls_support_during_setup.md

Example command to initialize a PingDirectory server with TLS certificates and trust stores using the setup tool.

```shell
$ ./setup \
     --no-prompt \
     --acceptLicense \
     --ldapPort 389 \
     --ldapsPort 636 \
     --httpsPort 443 \
     --enableStartTLS \
     --useJavaKeyStore config/keystore \
     --keyStorePasswordFile config/keystore.pin \
     --certNickname server-cert \
     --useJavaTrustStore config/truststore \
     --trustStorePasswordFile config/truststore.pin \
     --baseDN dc=example,dc=com \
     --rootUserDN "cn=Directory Manager" \
     --rootUserPasswordFile root-pw.txt \
     --maxHeapSize 10g \
     --encryptDataWithPassphraseFromFile encryption-settings-password.txt \
     --instanceName ds1 \
     --location Austin \
     --noPropertiesFile
```

--------------------------------

### Configure PingDirectoryProxy with setup utility

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_join_dps_existing_ds_topology.md

Use the setup utility with specific arguments to initialize a new proxy instance and join an existing topology.

```shell
$ ./setup --acceptLicense \
     --licenseKeyFile PingDirectory.lic
     --maxHeapSize 2g \
     --localHostName proxy2.example.com \
     --skipHostnameCheck \
     --instanceName proxy2 \
     --location Austin \
     --rootUserDN "cn=Directory Manager" \
     --rootUserPasswordFile directory-manager-password.txt \
     --ldapPort 389 \
     --ldapsPort 636 \
     --httpsPort 443 \
     --enableStartTLS \
     --useJavaKeyStore config/keystore \
     --keyStorePasswordFile config/keystore.pin \
     --certNickname server-cert \
     --useJavaTrustStore config/truststore \
     --trustStorePasswordFile config/truststore.pin \
     --encryptDataWithPassphraseFromFile encryption-passphrase.txt \
     --peerHostName proxy1.example.com \
     --peerPort 636 \
     --peerUseSSL \
     --no-prompt
```

--------------------------------

### Install PingDirectory Server on Austin Node 1

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_example_config_entry_bal_replication.md

Initial installation command for the first Austin server instance.

```bash
root@austin1# ./setup --baseDN dc=example,dc=com \
--ldapPort 389 --rootUserDN "cn=Directory Manager" \
--rootUserPassword pass --no-prompt --acceptLicense \
--instanceName ds1 --location Austin
```

--------------------------------

### Run setup command for PingDirectoryProxy with trust store

Source: https://docs.pingidentity.com/pingdirectory/11.1/installing_the_pingdirectory_suite_of_products/pd_proxy_install_dir_proxy_server.md

Executes the setup script with parameters for SSL/StartTLS, specifying the paths to the Java keystore and truststore files.

```shell
$ env JAVA_HOME=/ds/java ./setup \
  --no-prompt --rootUserDN "cn=Directory Manager" \
  --rootUserPassword "password" --ldapPort 389 \
  --enableStartTLS --ldapsPort 636 \
  --useJavaKeystore /path/to/devkeystore.jks \
  --keyStorePasswordFile /path/to/devkeystore.pin \
  --certNickName server-cert \
  --useJavaTrustStore /path/to/devtruststore.jks \
  --trustStorePasswordFile /path/to/devtruststore.pin \
  --acceptLicense \
  --instanceName ds1 --location Denver
```

--------------------------------

### Select Proxy Transformations CLI Example

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_create_request_processor_manage_proxy_trans.md

This example shows the interactive CLI prompt for selecting multiple proxy transformations by entering their corresponding numbers.

```text
Select the Proxy Transformations you wish to add:

    1)  sample-to-example       5)  sampleLinkedAccounts-to-
                                    exSampleLinkedAccounts
    2)  sample_east-to-example  6)  sampleRegion-to-
                                    exSampleRegion
    3)  sample_west-to-example  7)  Create a new Proxy
                                    Transformation
    4)  sampleID-to-uid         8)  Add all Proxy Transformations

    ?)  help
    b)  back
    q)  quit

Enter one or more choices separated by commas [b]: 4,5,6,2,3,1
```

--------------------------------

### Install the second PingDirectory server

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_deploy_basic_replication_topology.md

Installs the second server to be used in the replication topology.

```shell
$ ./setup --acceptLicense --baseDN "dc=example,dc=com" --ldapPort 1389 \
  --rootUserPassword pass --no-prompt
```

--------------------------------

### Setup PingDirectoryProxy in an Existing Topology

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_join_dps_existing_ds_topology.md

Use the setup command with topology-specific arguments to integrate a new proxy instance into an existing PingDirectory server environment.

```bash
$ ./setup --acceptLicense \
     --licenseKeyFile PingDirectory.lic
     --maxHeapSize 2g \
     --localHostName proxy1.example.com \
     --skipHostnameCheck \
     --instanceName proxy1 \
     --location Austin \
     --rootUserDN "cn=Directory Manager" \
     --rootUserPasswordFile directory-manager-password.txt \
     --ldapPort 389 \
     --ldapsPort 636 \
     --httpsPort 443 \
     --enableStartTLS \
     --useJavaKeyStore config/keystore \
     --keyStorePasswordFile config/keystore.pin \
     --certNickname server-cert \
     --useJavaTrustStore config/truststore \
     --trustStorePasswordFile config/truststore.pin \
     --encryptDataWithPassphraseFromFile encryption-passphrase.txt \
     --existingDSTopologyHostName ds1.example.com \
     --existingDSTopologyPort 636 \
     --existingDSTopologyBindDN "cn=Directory Manager" \
     --existingDSTopologyBindPasswordFile directory-manager-password.txt \
     --existingDSTopologyUseSSL \
     --existingDSTopologyUseJavaTrustStore config/truststore \
     --no-prompt
```

--------------------------------

### Start Server with Last Known Good Configuration

Source: https://docs.pingidentity.com/pingdirectory/11.1/troubleshooting_the_pingdirectory_suite_of_products/pd_ds_server_will_not_start.md

Attempts to start the server using the configuration from the last successful startup.

```shell
$ bin/start-server --useLastKnownGoodConfig
```

--------------------------------

### Install a Java-based extension

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_config_http_servlet_ext.html

Use the manage-extension tool to install a pre-built extension bundle from a ZIP file.

```shell
$ bin/manage-extension --install/path/to/extension.zip
```

--------------------------------

### Monitor Entry Output Example

Source: https://docs.pingidentity.com/pingdirectory/11.1/troubleshooting_the_pingdirectory_suite_of_products/pd_ds_server_disconnect_client_connection.md

Example output showing active operations and their associated connection IDs.

```text
dn: cn=Active Operations,cn=monitor
objectClass: top
objectClass: ds-monitor-entry
objectClass: ds-active-operations-monitor-entry
objectClass: extensibleObject
cn: Active Operations
num-operations-in-progress: 2
operation-in-progress: [15/Dec/2014:10:55:35 -0600] SEARCH conn=6 op=3 msgID=4
     clientIP="10.8.4.21" authDN="cn=app1,ou=applications,dc=example,dc=com" base="dc
     =example,dc=com" scope=wholeSubtree filter="(description=expensive)" attrs="A
     LL" unindexed=true
operation-in-progress: [15/Dec/2014:10:56:11 -0600] SEARCH conn=7 op=1 msgID=2
     clientIP="127.0.0.1" authDN="cn=Directory Manager,cn=Root DNs,cn=config" base="c
     n=monitor" scope=wholeSubtree filter="(cn=active operations)" attrs="ALL"
     num-persistent-searches-in-progress: 0
```

--------------------------------

### Run setup with a specific Java environment

Source: https://docs.pingidentity.com/pingdirectory/11.1/installing_the_pingdirectory_suite_of_products/pd_ds_install_server.md

Execute the setup command using a specific JDK path by overriding the JAVA_HOME environment variable.

```shell
$ env JAVA_HOME=/ds/java ./setup
```

--------------------------------

### Example Directory Server Tokens

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdatasync_server_administration_guide/pd_sync_thru_proxy_server_overview.html

Illustrative examples of tokens containing server ID, change number, and replica state for two different servers.

```text
Directory Server Token A:
  serverID A, changeNumber 1003, replicaState {15(A)}

Directory Server Token B:
  serverID B, changeNumber 2005, replicaState {12(B), 15(A)}
```

--------------------------------

### Set up a server instance with manage-profile

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_set_up_initial_topology.md

Use this command to install and configure a server instance using a specified profile and variables file.

```bash
manage-profile setup \
  --profile /path/to/server-profile \
  --profileVariablesFile /path/to/instance-specific-variables.properties
```

--------------------------------

### GET Request for Backend Information

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_config_api_dsconfig_tool_rel.md

Example of a GET request to retrieve properties for the userRoot backend.

```http
GET /config/backends/userRoot
Host: example.com:5033
Accept: application/scim+json
```

--------------------------------

### Run the create-initial-proxy-config tool

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_config_standard_dps_deployment.md

Execute the configuration tool from the server root directory to begin the setup process.

```shell
$ ./bin/create-initial-proxy-config
```

--------------------------------

### Configure Java environment for setup

Source: https://docs.pingidentity.com/pingdirectory/11.1/troubleshooting_the_pingdirectory_suite_of_products/pd_ds_server_will_not_run_setup.md

Use these commands to explicitly define the Java environment when the setup tool fails to detect a suitable installation.

```bash
env JAVA_HOME=/ds/java ./setup
```

```bash
env UNBOUNDID_JAVA_HOME="/ds/java" UNBOUNDID_JAVA_BIN="" ./setup
```

--------------------------------

### Run the create-initial-proxy-config tool

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_config_first_dps.md

Execute the tool from the bin directory to begin the interactive configuration process.

```bash
root@proxy-east01: bin/create-initial-proxy-config
```

--------------------------------

### GET Configuration API Response

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_config_api_dsconfig_tool_rel.md

Example of a SCIM ListResponse containing backend configuration resources.

```json
{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 24,
  "Resources": [
    {
      "schemas": [
        "urn:unboundid:schemas:configuration:2.0:backend:ldif"
      ],
      "id": "adminRoot",
      "meta": {
        "resourceType": "LDIF Backend",
        "location": "http://localhost:5033/config/backends/adminRoot"
      },
      "backendID": "adminRoot",
      "backupFilePermissions": "700",
      "baseDN": [
        "cn=topology,cn=config"
      ],
      "enabled": "true",
      "isPrivateBackend": "true",
      "javaClass": "com.unboundid.directory.server.backends.LDIFBackend",
      "ldifFile": "config/admin-backend.ldif",
      "returnUnavailableWhenDisabled": "true",
      "setDegradedAlertWhenDisabled": "false",
      "writabilityMode": "enabled"
    },
    {
      "schemas": [
        "urn:unboundid:schemas:configuration:2.0:backend:trust-store"
      ],
      "id": "ads-truststore",
      "meta": {
        "resourceType": "Trust Store Backend",
        "location": "http://localhost:5033/config/backends/ads-truststore"
      },
      "backendID": "ads-truststore",
      "backupFilePermissions": "700",
      "baseDN": [
        "cn=ads-truststore"
      ],
      "enabled": "true",
      "javaClass": "com.unboundid.directory.server.backends.TrustStoreBackend",
      "returnUnavailableWhenDisabled": "true",
      "setDegradedAlertWhenDisabled": "true",
      "trustStoreFile": "config/server.keystore",
      "trustStorePin": "**",
      "trustStoreType": "JKS",
      "writabilityMode": "enabled"
    },
    {
      "schemas": [
        "urn:unboundid:schemas:configuration:2.0:backend:alarm"
      ],
      "id": "alarms",
      "meta": {
        "resourceType": "Alarm Backend",
        "location": "http://localhost:5033/config/backends/alarms"
      },
  ...
```

--------------------------------

### Running the setup tool for proxy instances

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_config_additional_dps_instances.md

Execute the setup tool with the appropriate flags to configure a new PingDirectoryProxy instance, specifying network, security, and peer configuration.

```bash
root@proxy-east-02: ./setup --no-prompt \
--listenAddress proxy-east-02.example.com \
--ldapPort 389 --enableStartTLS --ldapsPort 636 \
--useJavaKeystore config/ExampleKeystore.jks \
--keyStorePasswordFile config/ExampleKeystore.pin \
--certNickName server-cert \
--useJavaTrustStore config/ExampleTruststore.jks \
--rootUserPassword pass --acceptLicense \
--maxHeapSize 1g --localHostName proxy-east-02.example.com \
--peerHostName proxy-east-01.example.com \
--peerPort 389 --location east
```

```bash
root@proxy-west-01: ./setup --no-prompt \
--listenAddress proxy-west-01.example.com \
--ldapPort 389 --enableStartTLS --ldapsPort 636 \
--useJavaKeystore config/ExampleKeystore.jks \
--keyStorePasswordFile config/ExampleKeystore.pin \
--certNickName server-cert \
--useJavaTrustStore config/ExampleTruststore.jks \
--rootUserPassword pass --acceptLicense \
--maxHeapSize 1g --localHostName proxy-west-01.example.com \
--peerHostName proxy-east-01.example.com \
--peerPort 389 --location west
```

--------------------------------

### Join a topology using interactive setup

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_join_dps_existing_ds_topology.md

This interactive prompt sequence demonstrates how to add a new PingDirectoryProxy server to an existing topology by connecting to a peer server.

```text
Do you accept the terms of this license agreement?  Enter 'yes' to accept,
'no' to reject, or press ENTER to display the next page of the agreement []: yes

Would you like to add this server to an existing Directory Proxy Server
topology? (yes / no) [no]: yes

Enter the host name of the peer Directory Proxy Server from which you would
like to copy configuration settings. [proxy2.example.com]: proxy1.example.com

Enter the LDAP port of the peer Directory Proxy Server [389]: 636

How would you like to connect to the peer Directory Proxy Server?

    1)  None
    2)  SSL
    3)  StartTLS

Enter option [1]: 2

Enter the manager account DN for the peer Directory Proxy Server [cn=Directory
Manager]: cn=Directory Manager

Enter the password for cn=Directory Manager:
The server presented the following certificate chain:

     Subject: CN=proxy1.example.com,O=Example Corp,C=US
     Valid From: Saturday, November 2, 2019 at 10:34:09 PM CDT
     Valid Until: Sunday, November 1, 2020 at 09:34:09 PM CST
     SHA-1 Fingerprint: 54:7f:6c:c1:99:73:c4:19:66:6e:da:4b:ee:a9:d5:62:24:2e:ba:41
     256-bit SHA-2 Fingerprint: 54:ce:59:c5:25:85:95:17:17:69:e0:5c:57:9e:ed:27:3d:af:9c:bd:34:51:c8:46:1e:e4:2f:31:13:18:31:ca
     -
     Issuer 1 Subject: CN=Example Certification Authority,O=Example Corp,C=US
     Valid From: Saturday, November 2, 2019 at 10:34:03 PM CDT
     Valid Until: Friday, October 28, 2039 at 10:34:03 PM CDT
     SHA-1 Fingerprint: 34:25:1f:8f:18:ff:a8:a9:ac:22:d3:d2:fc:bb:0b:4c:53:e1:8c:de
     256-bit SHA-2 Fingerprint: 51:69:1f:bb:cf:6f:1c:7a:e6:d4:6d:5a:01:c7:08:45:88:53:fc:75:f1:63:bb:ec:65:f1:1f:4e:26:f0:89:a3

Do you wish to trust this certificate?  Enter 'y' or 'n': y
```

--------------------------------

### Install PingDirectory Server Instances

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_example_config_entry_bal_replication.md

Commands to initialize new server instances with specific base DNs, ports, and locations.

```bash
root@austin2 # ./setup --baseDN dc=example,dc=com \
   --ldapPort 389 --rootUserDN "cn=Directory Manager" \
   --rootUserPassword pass --no-prompt --acceptLicense \
   --instanceName ds2 --location Austin
```

```bash
root@newyork1# ./setup --baseDN dc=example,dc=com \
--ldapPort 389 --rootUserDN "cn=Directory Manager" \
--rootUserPassword pass --no-prompt --acceptLicense \
--instanceName ds3 --location NewYork
```

```bash
root@newyork# ./setup --baseDN dc=example,dc=com \
--ldapPort 389 --rootUserDN "cn=Directory Manager" \
--rootUserPassword pass --no-prompt --acceptLicense \
--instanceName ds4 --location NewYork
```

--------------------------------

### Change file ownership for server installation

Source: https://docs.pingidentity.com/pingdirectory/11.1/troubleshooting_the_pingdirectory_suite_of_products/pd_sync_install_maint_issues.md

Execute this command as root to restore correct file permissions when the server has been started by the wrong user.

```shell
$ chown -R ds:other /ds/PingData<server>
```

--------------------------------

### Non-interactive PingDirectory setup with SSL and StartTLS

Source: https://docs.pingidentity.com/pingdirectory/11.1/installing_the_pingdirectory_suite_of_products/pd_ds_install_server.md

Executes the setup script with the --no-prompt flag to configure the server with specified keystore and truststore parameters.

```shell
$ ./setup --no-prompt --rootUserPassword "password" \
  --baseDN "dc=example,dc=com" --ldapPort 389 --enableStartTLS \
  --ldapsPort 636 --useJavaKeystore config/keystore.jks \
  --keyStorePasswordFile config/keystore.pin \
  --certNickName server-cert --useJavaTrustStore config/truststore.jks \
  --acceptLicense --instancename Instance1 --location Location1
```

--------------------------------

### Identify Server Lock Conflict Error

Source: https://docs.pingidentity.com/pingdirectory/11.1/troubleshooting_the_pingdirectory_suite_of_products/pd_ds_server_will_not_start.md

Example of the error message displayed when the server fails to start due to an existing lock file.

```text
The Diretory Server could not acquire an exclusive lock on file
/ds/the/locks/server.lock: The exclusive lock requested for file
/ds/the/locks/ server.lock was not granted, which indicates
that another process already holds a shared or exclusive lock on that
file. This generally means that another instance of this server is already
running
```

--------------------------------

### Define ACI with OAuth scope

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_use_oauth_scopes_aci_rest_api.md

This ACI allows users with the 'example:scope' OAuth scope to perform the Get Password Quality Requirements extended operation.

```text
(extop="1.3.6.1.4.1.30221.2.6.43")(version 3.0; acl "Extended op permissions for get password quality requirements"; allow (read) oauthscope="example:scope";)
```

--------------------------------

### Initial Configuration Menu

Source: https://docs.pingidentity.com/pingdirectory/11.1/installing_the_pingdirectory_suite_of_products/pd_proxy_install_dir_proxy_server.md

Displays the post-installation menu for selecting the initial configuration method.

```text
This server is now ready for configuration What would you like to do?

   1) Start 'create-initial-proxy-config' to create a basic
      initial configuration (recommended for new users)
   2) Start 'dsconfig' to create a configuration from scratch
   3) Quit

Enter choice [1]:
```

--------------------------------

### Start PingDirectoryProxy service

Source: https://docs.pingidentity.com/pingdirectory/11.1/installing_the_pingdirectory_suite_of_products/pd_suite_start_server_boot_time.md

Starts the PingDirectoryProxy service using systemctl.

```shell
$ systemctl start ping-directory-proxy.service
```

--------------------------------

### Extract and navigate to installation directory

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectoryproxy_server_administration_guide/pd_proxy_install_first_dps.md

Unzips the installation archive and changes the working directory.

```bash
root@proxy-east-01: unzip -q PingDirectoryProxy-<version>-with-je.zip
root@proxy-east-01: cd PingDirectoryProxy
```

--------------------------------

### JSON Attribute Data Examples

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdatasync_server_administration_guide/pd_sync_retain_dest_only_fields.md

Examples of JSON attribute states during synchronization updates.

```json
ubidEmailJSON: {"value" : "jsmith@example.com",
                "type" : "home"}
```

```json
ubidEmailJSON: {"value" : "jsmith@example.com",
                "type" : "home",
                "verified" : true},
```

```json
ubidEmailJSON: {"value" : "jsmith@example.com",
                "type" : "other"}
```

```json
ubidEmailJSON: {"value" : "jsmith@example.com",
                "type" : "other",
                "verified" : true}
```

```json
ubidEmailJSON: {"value" : "john.smith@example.com",
                "type" : "home"}
```

```json
ubidEmailJSON: {"value" : "john.smith@example.com",
                "type" : "home"}
```

--------------------------------

### Start server in lockdown mode

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_perform_disaster_recovery.md

Starts the server in lockdown mode, skipping the prime process.

```bash
bin/start-server --skipPrime --lockdownMode
```

--------------------------------

### Configure Sync User Account

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdatasync_server_administration_guide/pd_sync_config_dir_database_sync_pipe.md

Example output confirming the creation of the Sync User account and the enabling of the change log.

```text
Created 'cn=Sync User,cn=Root DNs,cn=config'
Verifying base DN 'dc=example,dc=com'	Done
Enabling cn=changelog .....
```

--------------------------------

### Audit Log Output Example

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_manage_file_based_audit_log_pubs.md

Example of the LDIF-formatted output generated in the audit log file.

```ldif
# 05/Jun/2011:10:29:04 -0500; conn=0; op=55
dn: cn=File-Based Audit Logger,cn=Loggers,cn=config
changetype: modify
replace: ds-cfg-enabled
ds-cfg-enabled: true
-
replace: modifiersName
modifiersName: cn=Directory Manager,cn=Root DNs,cn=config
-
replace: modifyTimestamp
modifyTimestamp: 20131010020345.546Z

# 05/Jun/2011:10:31:20 -0500; conn=2; op=1
dn: uid=user.996,ou=People,dc=example,dc=com
changetype: modify
replace: pager
pager: +1 115 426 4748
-
replace: homePhone
homePhone: +1 407 383 4949
-
replace: modifiersName
modifiersName: cn=Directory Manager,cn=Root DNs,cn=config
-
replace: modifyTimestamp
modifyTimestamp: 20131010020345.546Z
```

--------------------------------

### Initialize server

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_perform_disaster_recovery.md

Initializes a server from another server in the topology.

```bash
bin/dsreplication initialize
```

--------------------------------

### Resync command output example

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdatasync_server_administration_guide/pd_sync_specific_list_dns.md

Example output showing the status and results of a resync operation.

```text
Starting pass 1
[20/Mar/2016:10:32:11 -0500]
-------------------------------------
Resync pass 1
Source entries retrieved 1999
Entries created 981
Current pass, entries processed 981
Duration (seconds) 10
Average ops/second 98
Status after completing all passes[20/Mar/2016:10:32:18 -0500]
----------------------------------
Source entries retrieved 2003
Entries created 2003
Duration (seconds) 16
Average ops/second 98
Resync completed in 16 s.
0 entries were in-sync, 0 entries were modified, 2003 entries were
created, 0 entries are still out-of-sync, 0 entries are still missing, and
0 entries could not be processed due to an error
```

--------------------------------

### GET Request for Backends List

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_config_api_dsconfig_tool_rel.md

An HTTP GET request to retrieve a list of all configured backends.

```http
GET /config/backends/
Host: example.com:5033
Accept: application/scim+json
```

--------------------------------

### Example properties file content

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_eval_cmdline_file_options.md

A sample properties file configuration for tool settings.

```properties
hostname=server1.example.com
port=1389
bindDN=cn=Directory\ Manager
bindPassword=secret
```

--------------------------------

### Run the create-sync-pipe-config tool

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdatasync_server_administration_guide/pd_sync_config_dir_database_sync_pipe.md

Initiates the interactive configuration tool for setting up synchronization pipes.

```bash
$ bin/create-sync-pipe-config
```

--------------------------------

### move-subtree output example

Source: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_modify_entries_ldapmodify.md

Example output showing successful moves and error handling for existing entries.

```text
An error occurred while communicating with the target server: The entry
uid=user.2,ou=People,dc=example,dc=com cannot be added because an entry with that name
already exists
Entry uid=user.3,ou=People,dc=example,dc=com was successfully moved from
source.example.com:389 to target.example.com:389
Entry uid=user.4,ou=People,dc=example,dc=com was successfully moved from
source.example.com:389 to target.example.com:389
```
Tokens:
Raw