Ping Identity DevOps Docker Image - `pingdelegator`

This docker image provides an NGINX instance with PingDelegator that can be used in administering PingDirectory Users/Groups.

pingidentity/pingbase - Parent Image

Environment Variables

The following environment ENV variables can be used with this image.

ENV Variable	Default	Description
BASE	${BASE:-/opt}
JAVA_HOME	/opt/java
STAGING_DIR	${BASE}/staging	Path to the staging area where the remote and local server profiles can be merged
OUT_DIR	${BASE}/out	Path to the runtime volume
SERVER_ROOT_DIR	${OUT_DIR}/instance	Path from which the runtime executes
ROOT_USER	administrator	The default administrative user for PingData (v1 pingbase carrier default). Declared in its own ENV statement before the block below so ROOT_USER_DN expands at build time — Docker does not expand ENV values against vars declared later or in the same statement.
IN_DIR	${BASE}/in	Location of a local server-profile volume
SERVER_BITS_DIR	${BASE}/server	Path to the server bits
BAK_DIR	${BASE}/backup	Path to a volume generically used to export or backup data
LOGS_DIR	${BASE}/logs	Path to a volume generically used for logging
STAGING_MANIFEST	${BASE}/staging-manifest.txt	Path to a manifest of files expected in the staging dir on first image startup
CLEAN_STAGING_DIR	false	Whether to clean the staging dir when the container starts
SECRETS_DIR	/run/secrets	Default path to the secrets
TOPOLOGY_FILE	${STAGING_DIR}/topology.json	Path to the topology file
HOOKS_DIR	${STAGING_DIR}/hooks	Path where all the hooks scripts are stored
CONTAINER_ENV	${STAGING_DIR}/.env	Environment Property file use to share variables between scripts in container
SERVER_PROFILE_DIR	/tmp/server-profile	Path where the remote server profile is checked out or cloned before being staged prior to being applied on the runtime
SERVER_PROFILE_URL		A valid git HTTPS URL (not ssh)
SERVER_PROFILE_URL_REDACT	true	When set to "true", the server profile git URL will not be printed to container output.
SERVER_PROFILE_BRANCH		A valid git branch (optional)
SERVER_PROFILE_PATH		The subdirectory in the git repo
SERVER_PROFILE_UPDATE	false	Whether to update the server profile upon container restart
SECURITY_CHECKS_STRICT	false	Requires strict checks on security
SECURITY_CHECKS_FILENAME	.jwk .pin	Perform a check for filenames that may violate security (i.e. secret material)
UNSAFE_CONTINUE_ON_ERROR		If this is set to true, then the container will provide a hard warning and continue.
LICENSE_DIR	${SERVER_ROOT_DIR}	License directory
STARTUP_FOREGROUND_OPTS		The command-line options to provide to the startup command when the container starts with the server in the foreground. This is the normal start flow for the container
STARTUP_BACKGROUND_OPTS		The command-line options to provide to the startup command when the container starts with the server in the background. This is the debug start flow for the container
PING_IDENTITY_DEVOPS_KEY_REDACT	true
PING_IDENTITY_ACCEPT_EULA	NO	Legal requirement to explicitly accept the terms of the PingIdentity License Must be set to 'YES' for the container to start
PING_IDENTITY_DEVOPS_FILE	devops-secret	File name for devops-creds passed as a Docker secret
TAIL_LOG_FILES		A whitespace separated list of log files to tail to the container standard output - DO NOT USE WILDCARDS like /path/to/logs/*.log
COLORIZE_LOGS	true	If 'true', the output logs will be colorized with GREENs and REDs, otherwise, no colorization will be done. This is good for tools that monitor logs and colorization gets in the way.
LOCATION	Docker	Location default value
LOCATION_VALIDATION	true	Validation toggle for LOCATION: true to require any string denoting a logical/physical location, false to disable the check
VERBOSE	false	Triggers verbose messages in scripts using the set -x option.
PING_DEBUG	false	Set the server in debug mode, with increased output
PING_PRODUCT		The name of Ping product, i.e. PingFederate, PingDirectory - must be a valid Ping product type. This variable should be overridden by child images.
PING_PRODUCT_VALIDATION	true	Validation toggle for PING_PRODUCT: true to require a valid Ping product type (e.g. PingFederate,PingDirectory), false to disable the check
LDAP_PORT	1389	Port over which to communicate for LDAP
LDAPS_PORT	1636	Port over which to communicate for LDAPS
HTTPS_PORT	1443	Port over which to communicate for HTTPS
JMX_PORT	1689	Port for monitoring over JMX protocol
ORCHESTRATION_TYPE		The type of orchestration tool used to run the container, normally set in the deployment (.yaml) file. Expected values include: - compose - swarm - kubernetes Defaults to blank (i.e. No type is set)
USER_BASE_DN	dc=example,dc=com	Base DN for user data
DOLLAR	'$'	Variable with a literal value of '$', to avoid unwanted variable substitution
ROOT_USER_DN	cn=${ROOT_USER}	DN of the server root user
ENV	${BASE}/.profile
PS1	\${PING_PRODUCT}:\h:\w\n>	Default shell prompt (i.e. productName:hostname:workingDir)
PATH	${JAVA_HOME}/bin:${BASE}:${SERVER_ROOT_DIR}/bin:${PATH}	PATH used by the container
IMAGE_VERSION	${IMAGE_VERSION}
IMAGE_GIT_REV	${IMAGE_GIT_REV}
DATE	${DATE}
PING_PRODUCT_VERSION	${VERSION}
PD_DELEGATOR_PUBLIC_HOSTNAME	localhost
PD_DELEGATOR_HTTP_PORT	6080
PD_DELEGATOR_HTTPS_PORT	6443
PING_PRODUCT	PingDelegator	Ping product name
PF_ENGINE_PUBLIC_HOSTNAME	localhost	The hostname for the public Ping Federate instance used for SSO.
PF_ENGINE_PUBLIC_PORT	9031	The port for the public Ping Federate instance used for SSO. NOTE: If using port 443 along with a base URL with no specified port, set to an empty string.
PF_DELEGATOR_CLIENTID	dadmin	The client id that was set up with Ping Federate for Ping Delegator.
PD_ENGINE_PUBLIC_HOSTNAME	localhost	The hostname for the DS instance the app will be interfacing with.
PD_ENGINE_PUBLIC_PORT	1443	The HTTPS port for the DS instance the app will be interfacing with.
PD_DELEGATOR_TIMEOUT_LENGTH_MINS	30	The length of time (in minutes) until the session will require a new login attempt
PD_DELEGATOR_HEADER_BAR_LOGO		The filename used as the logo in the header bar, relative to this application’s build directory. Note about logos: The size of the image will be scaled down to fit 22px of height and a max-width of 150px. For best results, it is advised to make the image close to this height and width ratio as well as to crop out any blank spacing around the logo to maximize its presentation. e.g. '${SERVER_ROOT_DIR}/html/delegator/images/my_company_logo.png'
PD_DELEGATOR_DADMIN_API_NAMESPACE		The namespace for the Delegated Admin API on the DS instance. In most cases, this does not need to be set here. e.g. 'dadmin/v2'
PD_DELEGATOR_PROFILE_SCOPE_ENABLED	false	Set to true if the "profile" scope is supported for the Delegated Admin OIDC client on PingFederate and you wish to use it to show the current user’s name in the navigation.
NGINX_WORKER_PROCESSES	auto	The number of NginX worker processes — Default: auto
NGINX_WORKER_CONNECTIONS	1024	The number of NginX worker connections — Default: 1024
STARTUP_COMMAND	nginx	The command that the entrypoint will execute in the foreground to instantiate the container
STARTUP_FOREGROUND_OPTS	-c ${SERVER_ROOT_DIR}/etc/nginx.conf	The command-line options to provide to the startup command when the container starts with the server in the foreground. This is the normal start flow for the container
STARTUP_BACKGROUND_OPTS	${STARTUP_FOREGROUND_OPTS}	The command-line options to provide to the startup command when the container starts with the server in the background. This is the debug start flow for the container

ENV Variable

Default

Description

BASE

${BASE:-/opt}

JAVA_HOME

/opt/java

STAGING_DIR

${BASE}/staging

Path to the staging area where the remote and local server profiles can be merged

OUT_DIR

${BASE}/out

Path to the runtime volume

SERVER_ROOT_DIR

${OUT_DIR}/instance

Path from which the runtime executes

ROOT_USER

administrator

The default administrative user for PingData (v1 pingbase carrier default). Declared in its own ENV statement before the block below so ROOT_USER_DN expands at build time — Docker does not expand ENV values against vars declared later or in the same statement.

IN_DIR

${BASE}/in

Location of a local server-profile volume

SERVER_BITS_DIR

${BASE}/server

Path to the server bits

BAK_DIR

${BASE}/backup

Path to a volume generically used to export or backup data

LOGS_DIR

${BASE}/logs

Path to a volume generically used for logging

STAGING_MANIFEST

${BASE}/staging-manifest.txt

Path to a manifest of files expected in the staging dir on first image startup

CLEAN_STAGING_DIR

false

Whether to clean the staging dir when the container starts

SECRETS_DIR

/run/secrets

Default path to the secrets

TOPOLOGY_FILE

${STAGING_DIR}/topology.json

Path to the topology file

HOOKS_DIR

${STAGING_DIR}/hooks

Path where all the hooks scripts are stored

CONTAINER_ENV

${STAGING_DIR}/.env

Environment Property file use to share variables between scripts in container

SERVER_PROFILE_DIR

/tmp/server-profile

Path where the remote server profile is checked out or cloned before being staged prior to being applied on the runtime

SERVER_PROFILE_URL

A valid git HTTPS URL (not ssh)

SERVER_PROFILE_URL_REDACT

true

When set to "true", the server profile git URL will not be printed to container output.

SERVER_PROFILE_BRANCH

A valid git branch (optional)

SERVER_PROFILE_PATH

The subdirectory in the git repo

SERVER_PROFILE_UPDATE

false

Whether to update the server profile upon container restart

SECURITY_CHECKS_STRICT

false

Requires strict checks on security

SECURITY_CHECKS_FILENAME

*.jwk *.pin

Perform a check for filenames that may violate security (i.e. secret material)

UNSAFE_CONTINUE_ON_ERROR

If this is set to true, then the container will provide a hard warning and continue.

LICENSE_DIR

${SERVER_ROOT_DIR}

License directory

STARTUP_FOREGROUND_OPTS

The command-line options to provide to the startup command when the container starts with the server in the foreground. This is the normal start flow for the container

STARTUP_BACKGROUND_OPTS

The command-line options to provide to the startup command when the container starts with the server in the background. This is the debug start flow for the container

PING_IDENTITY_DEVOPS_KEY_REDACT

true

PING_IDENTITY_ACCEPT_EULA

Legal requirement to explicitly accept the terms of the PingIdentity License Must be set to 'YES' for the container to start

PING_IDENTITY_DEVOPS_FILE

devops-secret

File name for devops-creds passed as a Docker secret

TAIL_LOG_FILES

A whitespace separated list of log files to tail to the container standard output - DO NOT USE WILDCARDS like /path/to/logs/*.log

COLORIZE_LOGS

true

If 'true', the output logs will be colorized with GREENs and REDs, otherwise, no colorization will be done. This is good for tools that monitor logs and colorization gets in the way.

LOCATION

Docker

Location default value

LOCATION_VALIDATION

true

Validation toggle for LOCATION: true to require any string denoting a logical/physical location, false to disable the check

VERBOSE

false

Triggers verbose messages in scripts using the set -x option.

PING_DEBUG

false

Set the server in debug mode, with increased output

PING_PRODUCT

The name of Ping product, i.e. PingFederate, PingDirectory - must be a valid Ping product type. This variable should be overridden by child images.

PING_PRODUCT_VALIDATION

true

Validation toggle for PING_PRODUCT: true to require a valid Ping product type (e.g. PingFederate,PingDirectory), false to disable the check

LDAP_PORT

1389

Port over which to communicate for LDAP

LDAPS_PORT

1636

Port over which to communicate for LDAPS

HTTPS_PORT

1443

Port over which to communicate for HTTPS

JMX_PORT

1689

Port for monitoring over JMX protocol

ORCHESTRATION_TYPE

The type of orchestration tool used to run the container, normally set in the deployment (.yaml) file. Expected values include: - compose - swarm - kubernetes Defaults to blank (i.e. No type is set)

USER_BASE_DN

dc=example,dc=com

Base DN for user data

DOLLAR

'$'

Variable with a literal value of '$', to avoid unwanted variable substitution

ROOT_USER_DN

cn=${ROOT_USER}

DN of the server root user

ENV

${BASE}/.profile

PS1

\${PING_PRODUCT}:\h:\w\n>

Default shell prompt (i.e. productName:hostname:workingDir)

PATH

${JAVA_HOME}/bin:${BASE}:${SERVER_ROOT_DIR}/bin:${PATH}

PATH used by the container

IMAGE_VERSION

${IMAGE_VERSION}

IMAGE_GIT_REV

${IMAGE_GIT_REV}

DATE

${DATE}

PING_PRODUCT_VERSION

${VERSION}

PD_DELEGATOR_PUBLIC_HOSTNAME

localhost

PD_DELEGATOR_HTTP_PORT

6080

PD_DELEGATOR_HTTPS_PORT

6443

PING_PRODUCT

PingDelegator

Ping product name

PF_ENGINE_PUBLIC_HOSTNAME

localhost

The hostname for the public Ping Federate instance used for SSO.

PF_ENGINE_PUBLIC_PORT

9031

The port for the public Ping Federate instance used for SSO. NOTE: If using port 443 along with a base URL with no specified port, set to an empty string.

PF_DELEGATOR_CLIENTID

dadmin

The client id that was set up with Ping Federate for Ping Delegator.

PD_ENGINE_PUBLIC_HOSTNAME

localhost

The hostname for the DS instance the app will be interfacing with.

PD_ENGINE_PUBLIC_PORT

1443

The HTTPS port for the DS instance the app will be interfacing with.

PD_DELEGATOR_TIMEOUT_LENGTH_MINS

The length of time (in minutes) until the session will require a new login attempt

PD_DELEGATOR_HEADER_BAR_LOGO

The filename used as the logo in the header bar, relative to this application’s build directory. Note about logos: The size of the image will be scaled down to fit 22px of height and a max-width of 150px. For best results, it is advised to make the image close to this height and width ratio as well as to crop out any blank spacing around the logo to maximize its presentation. e.g. '${SERVER_ROOT_DIR}/html/delegator/images/my_company_logo.png'

PD_DELEGATOR_DADMIN_API_NAMESPACE

The namespace for the Delegated Admin API on the DS instance. In most cases, this does not need to be set here. e.g. 'dadmin/v2'

PD_DELEGATOR_PROFILE_SCOPE_ENABLED

false

Set to true if the "profile" scope is supported for the Delegated Admin OIDC client on PingFederate and you wish to use it to show the current user’s name in the navigation.

NGINX_WORKER_PROCESSES

auto

The number of NginX worker processes — Default: auto

NGINX_WORKER_CONNECTIONS

1024

The number of NginX worker connections — Default: 1024

STARTUP_COMMAND

nginx

The command that the entrypoint will execute in the foreground to instantiate the container

STARTUP_FOREGROUND_OPTS

-c ${SERVER_ROOT_DIR}/etc/nginx.conf

The command-line options to provide to the startup command when the container starts with the server in the foreground. This is the normal start flow for the container

STARTUP_BACKGROUND_OPTS

${STARTUP_FOREGROUND_OPTS}

The command-line options to provide to the startup command when the container starts with the server in the background. This is the debug start flow for the container

Run

To run a PingDelegator container with HTTPS_PORT=6443 (6443 is simply a convention for PingDelegator so conflicts are reduced with other container HTTPS ports):

  docker run \
           --name pingdelegator \
           --publish 6443:6443 \
           --detach \
           --env PING_IDENTITY_ACCEPT_EULA=YES \
           --env PING_IDENTITY_DEVOPS_USER \
           --env PING_IDENTITY_DEVOPS_KEY \
           --tmpfs /run/secrets \
           pingidentity/pingdelegator:edge

PingDelegator requires running instances of PingFederate/PingDirectory.

Docker Container Hook Scripts

Please go here for details on all pingdelegator hook scripts

This document is auto-generated from pingdelegator/Dockerfile