Ping Identity DevOps Docker Image - `pingdirectory`

This docker image includes the Ping Identity PingDirectory product binaries and associated hook scripts to create and run a PingDirectory instance or instances.

pingidentity/pingbase-java - Parent Image

Environment Variables

The following environment ENV variables can be used with this image.

ENV Variable Default Description

ENV Variable	Default	Description
BASE	${BASE:-/opt}
ROOT_USER	administrator	the default administrative user for PingData
JAVA_HOME	/opt/java
STAGING_DIR	${BASE}/staging	Path to the staging area where the remote and local server profiles can be merged
OUT_DIR	${BASE}/out	Path to the runtime volume
SERVER_ROOT_DIR	${OUT_DIR}/instance	Path from which the runtime executes
IN_DIR	${BASE}/in	Location of a local server-profile volume
SERVER_BITS_DIR	${BASE}/server	Path to the server bits
BAK_DIR	${BASE}/backup	Path to a volume generically used to export or backup data
LOGS_DIR	${BASE}/logs	Path to a volume generically used for logging
STAGING_MANIFEST	${BASE}/staging-manifest.txt	Path to a manifest of files expected in the staging dir on first image startup
CLEAN_STAGING_DIR	false	Whether to clean the staging dir when the container starts
SECRETS_DIR	/run/secrets	Default path to the secrets
TOPOLOGY_FILE	${STAGING_DIR}/topology.json	Path to the topology file
HOOKS_DIR	${STAGING_DIR}/hooks	Path where all the hooks scripts are stored
CONTAINER_ENV	${STAGING_DIR}/.env	Environment Property file use to share variables between scripts in container
SERVER_PROFILE_DIR	/tmp/server-profile	Path where the remote server profile is checked out or cloned before being staged prior to being applied on the runtime
SERVER_PROFILE_URL		A valid git HTTPS URL (not ssh)
SERVER_PROFILE_URL_REDACT	true	When set to "true", the server profile git URL will not be printed to container output.
SERVER_PROFILE_BRANCH		A valid git branch (optional)
SERVER_PROFILE_PATH		The subdirectory in the git repo
SERVER_PROFILE_UPDATE	false	Whether to update the server profile upon container restart
SECURITY_CHECKS_STRICT	false	Requires strict checks on security
SECURITY_CHECKS_FILENAME	.jwk .pin	Perform a check for filenames that may violate security (i.e. secret material)
UNSAFE_CONTINUE_ON_ERROR		If this is set to true, then the container will provide a hard warning and continue.
LICENSE_DIR	${SERVER_ROOT_DIR}	License directory
PD_LICENSE_DIR	${STAGING_DIR}/pd.profile/server-root/pre-setup	PD License directory. Separating from above LICENSE_DIR to differentiate for different products
STARTUP_FOREGROUND_OPTS		The command-line options to provide to the startup command when the container starts with the server in the foreground. This is the normal start flow for the container
STARTUP_BACKGROUND_OPTS		The command-line options to provide to the startup command when the container starts with the server in the background. This is the debug start flow for the container
PING_IDENTITY_DEVOPS_KEY_REDACT	true
PING_IDENTITY_ACCEPT_EULA	NO	Legal requirement to explicitly accept the terms of the PingIdentity License Must be set to 'YES' for the container to start
PING_IDENTITY_DEVOPS_FILE	devops-secret	File name for devops-creds passed as a Docker secret
TAIL_LOG_FILES		A whitespace separated list of log files to tail to the container standard output - DO NOT USE WILDCARDS like /path/to/logs/*.log
COLORIZE_LOGS	true	If 'true', the output logs will be colorized with GREENs and REDs, otherwise, no colorization will be done. This is good for tools that monitor logs and colorization gets in the way.
LOCATION	Docker	Location default value If PingDirectory is deployed in multi cluster mode, that is, K8S_CLUSTER, K8S_CLUSTERS and K8S_SEED_CLUSTER are defined, LOCATION is ignored and K8S_CLUSTER is used as the location
LOCATION_VALIDATION	true	Validation toggle for LOCATION: true to require any string denoting a logical/physical location, false to disable the check
MAX_HEAP_SIZE	384m	Heap size (for java products)
JVM_TUNING	AGGRESSIVE
JAVA_RAM_PERCENTAGE	75.0	Percentage of the container memory to allocate to the JVM DO NOT set to 100% or your JVM will exit with OutOfMemory errors and the container will terminate
VERBOSE	false	Triggers verbose messages in scripts using the set -x option.
PING_DEBUG	false	Set the server in debug mode, with increased output
PING_PRODUCT		The name of Ping product, i.e. PingFederate, PingDirectory - must be a valid Ping product type. This variable should be overridden by child images.
PING_PRODUCT_VALIDATION	true	Validation toggle for PING_PRODUCT: true to require a valid Ping product type (e.g. PingFederate,PingDirectory), false to disable the check
ADDITIONAL_SETUP_ARGS		List of setup arguments passed to Ping Data setup-arguments.txt file
LDAP_PORT	1389	Port over which to communicate for LDAP
LDAPS_PORT	1636	Port over which to communicate for LDAPS
HTTPS_PORT	1443	Port over which to communicate for HTTPS
JMX_PORT	1689	Port for monitoring over JMX protocol
ORCHESTRATION_TYPE		The type of orchestration tool used to run the container, normally set in the deployment (.yaml) file. Expected values include: - compose - swarm - kubernetes Defaults to blank (i.e. No type is set)
USER_BASE_DN	dc=example,dc=com	Base DN for user data
DOLLAR	'$'	Variable with a literal value of '$', to avoid unwanted variable substitution
PD_ENGINE_PUBLIC_HOSTNAME	localhost	PD (PingDirectory) public hostname that may be used in redirects
PD_ENGINE_PRIVATE_HOSTNAME	pingdirectory	PD (PingDirectory) private hostname
PDP_ENGINE_PUBLIC_HOSTNAME	localhost	PDP (PingDirectoryProxy) public hostname that may be used in redirects
PDP_ENGINE_PRIVATE_HOSTNAME	pingdirectoryproxy	PDP (PingDirectoryProxy) private hostname
PDS_ENGINE_PUBLIC_HOSTNAME	localhost	PDS (PingDataSync) public hostname that may be used in redirects
PDS_ENGINE_PRIVATE_HOSTNAME	pingdatasync	PDS (PingDataSync) private hostname
PAZ_ENGINE_PUBLIC_HOSTNAME	localhost	PAZ (PingAuthorize) public hostname that may be used in redirects
PAZ_ENGINE_PRIVATE_HOSTNAME	pingauthorize	PAZ (PingAuthorize) private hostname
PAZP_ENGINE_PUBLIC_HOSTNAME	localhost	PAZP (PingAuthorize-PAP) public hostname that may be used in redirects
PAZP_ENGINE_PRIVATE_HOSTNAME	pingauthorizepap	PAZP (PingAuthorize-PAP) private hostname
PF_ENGINE_PUBLIC_HOSTNAME	localhost	PF (PingFederate) engine public hostname that may be used in redirects
PF_ENGINE_PRIVATE_HOSTNAME	pingfederate	PF (PingFederate) engine private hostname
PF_ADMIN_PUBLIC_BASEURL	https://localhost:9999	PF (PingFederate) admin public baseurl that may be used in redirects. PF_RUN_PF_ADMIN_BASEURL will override this value for PingFederate 11.3 and later.
PF_ADMIN_PUBLIC_HOSTNAME	localhost	PF (PingFederate) admin public hostname that may be used in redirects. PF_RUN_PF_ADMIN_HOSTNAME will override this value for PingFederate 11.3 and later.
PF_ADMIN_PRIVATE_HOSTNAME	pingfederate-admin	PF (PingFederate) admin private hostname
PA_ENGINE_PUBLIC_HOSTNAME	localhost	PA (PingAccess) engine public hostname that may be used in redirects
PA_ENGINE_PRIVATE_HOSTNAME	pingaccess	PA (PingAccess) engine private hostname
PA_ADMIN_PUBLIC_HOSTNAME	localhost	PA (PingAccess) admin public hostname that may be used in redirects
PA_ADMIN_PRIVATE_HOSTNAME	pingaccess-admin	PA (PingAccess) admin private hostname
ROOT_USER_DN	cn=${ROOT_USER}	DN of the server root user
ENV	${BASE}/.profile
PS1	\${PING_PRODUCT}:\h:\w\n>	Default shell prompt (i.e. productName:hostname:workingDir)
REGENERATE_JAVA_PROPERTIES	false	Whether to force a run of dsjavaproperties --initialize (false = only regenerate java.properties when the JVM or JVM options change)
PATH	${JAVA_HOME}/bin:${BASE}:${SERVER_ROOT_DIR}/bin:${PATH}	PATH used by the container
IMAGE_VERSION	${IMAGE_VERSION}
IMAGE_GIT_REV	${IMAGE_GIT_REV}
DATE	${DATE}
PING_PRODUCT_VERSION	${VERSION}
PING_PRODUCT	PingDirectory	Ping product name
LICENSE_DIR	${PD_LICENSE_DIR}	PD License directory (staged PingData profile pre-setup, where the PD license is placed by the staging hooks)
LICENSE_FILE_NAME	PingDirectory.lic	Name of license File
LICENSE_SHORT_NAME	PD	Short name used when retrieving license from License Server
LICENSE_VERSION	${LICENSE_VERSION}	Version used when retrieving license from License Server
REPLICATION_PORT	8989	Default PingDirectory Replication Port
ADMIN_USER_NAME	admin	Replication administrative user
STARTUP_COMMAND	${SERVER_ROOT_DIR}/bin/start-server	The command that the entrypoint will execute in the foreground to instantiate the container
PD_DELEGATOR_PUBLIC_HOSTNAME	localhost	Public hostname of the DA app
STARTUP_FOREGROUND_OPTS	--nodetach	The command-line options to provide to the startup command when the container starts with the server in the foreground. This is the normal start flow for the container
STARTUP_BACKGROUND_OPTS		The command-line options to provide to the startup command when the container starts with the server in the background. This is the debug start flow for the container
ROOT_USER_PASSWORD_FILE		Location of file with the root user password (i.e. cn=directory manager). Defaults to /SECRETS_DIR/root-user-password
ADMIN_USER_PASSWORD_FILE		Location of file with the admin password, used as the password replication admin Defaults to /SECRETS_DIR/admin-user-password
ENCRYPTION_PASSWORD_FILE		Location of file with the passphrase for setting up encryption Defaults to /SECRETS_DIR/encryption-password
KEYSTORE_FILE		Location of the keystore file containing the server certificate. If left undefined, the SECRETS_DIR will be checked for a keystore. If that keystore does not exist, the server will generate a self-signed certificate.
KEYSTORE_PIN_FILE		Location of the pin file for the keystore defined in KEYSTORE_FILE. You must specify a KEYSTORE_PIN_FILE when a KEYSTORE_FILE is present. This value does not need to be defined when allowing the server to generate a self-signed certificate.
KEYSTORE_TYPE		Format of the keystore defined in KEYSTORE_FILE. One of "jks", "pkcs12", "pem", or "bcfks" (in FIPS mode). If not defined, the keystore format will be inferred based on the file extension of the KEYSTORE_FILE, defaulting to "jks".
TRUSTSTORE_FILE		Location of the truststore file for the server. If left undefined, the SECRETS_DIR will be checked for a truststore. If that truststore does not exist, the server will generate a truststore, containing its own certificate.
TRUSTSTORE_PIN_FILE		Location of the pin file for the truststore defined in TRUSTSTORE_FILE. You must specify a TRUSTSTORE_PIN_FILE when a TRUSTSTORE_FILE is present. This value does not need to be defined when allowing the server to generate a truststore.
TRUSTSTORE_TYPE		Format of the truststore defined in TRUSTSTORE_FILE. One of "jks", "pkcs12", "pem", or "bcfks" (in FIPS mode). If not defined, the truststore format will be inferred based on the file extension of the TRUSTSTORE_FILE, defaulting to "jks".
TAIL_LOG_FILES	${SERVER_ROOT_DIR}/logs/access ${SERVER_ROOT_DIR}/logs/errors ${SERVER_ROOT_DIR}/logs/failed-ops ${SERVER_ROOT_DIR}/logs/config-audit.log ${SERVER_ROOT_DIR}/logs/debug-trace ${SERVER_ROOT_DIR}/logs/debug-aci ${SERVER_ROOT_DIR}/logs/tools/.log ${SERVER_BITS_DIR}/logs/tools/.log	Files tailed once container has started
MAKELDIF_USERS	0	Number of users to auto-populate using make-ldif templates
RETRY_TIMEOUT_SECONDS	180	The default retry timeout in seconds for dsreplication and remove-defunct-server
PD_PROFILE	${STAGING_DIR}/pd.profile	Directory for the profile used by the PingData manage-profile tool
FIPS_MODE_ON	false	Turns on FIPS mode (currently with the Bouncy Castle FIPS provider) set to exactly "true" lowercase to turn on set to anything else to turn off
FIPS_PROVIDER	BCFIPS	BCFIPS is the only provider currently supported — do not edit
PD_REBUILD_ON_RESTART	false	Force a rebuild (replace-profile) of a PingDirectory on restart. Used to ensure that the server configuration exactly matches the server profile. This variable will slow down startup times and should only be used when necessary.
UNBOUNDID_SKIP_START_PRECHECK_NODETACH	true	Setting this variable to true speeds up server startup time by skipping an unnecessary JVM check.
REPLICATION_BASE_DNS		Base DNs to include when enabling replication, in addition to the always-included USER_BASE_DN. Multiple base DNs can be specified here, separated by a `;` character
RESTRICTED_BASE_DNS		Base DNs to set as --restricted when enabling replication. Multiple base DNs can be specified here, separated by a `;` character. See the product documentation for more information on how to configure entry balancing.
PARALLEL_POD_MANAGEMENT_POLICY	false	Whether this container is running as a Pod in a Kubernetes StatefulSet, and that StatefulSet is using the Parallel podManagementPolicy. This property allows for starting up Pods in parallel to speed up the initial startup of PingDirectory topologies. This variable must be set to true when using the Parallel podManagementPolicy. Note: when using parallel startup, ensure the RETRY_TIMEOUT_SECONDS variable is large enough. The pods will be enabling replication simultaneously, so some pods will have to retry while waiting for others to complete. If the timeout is too low, a Pod may end up restarting unnecessarily.
SKIP_WAIT_FOR_DNS	false	Set to true to skip the waiting for DNS step that is normally done just before attempting to join the topology.
CERTIFICATE_NICKNAME		There is an additional certificate-based variable used to identity the certificate alias used within the `KEYSTORE_FILE`. That variable is called `CERTIFICATE_NICKNAME`, which identifies the certificate to use by the server in the `KEYSTORE_FILE`. If a value is not provided, the container will look at the list certs found in the `KEYSTORE_FILE` and if one - and only one - certificate is found of type `PrivateKeyEntry`, that alias will be used.
PD_FORCE_DATA_REIMPORT	false	Set to true to force PingDirectory to export and re-import its backend data on restart. Note that this process can take a long time for large backends.
LOAD_BALANCING_ALGORITHM_NAMES		The load-balancing algorithm names to set for this server instance. This variable is only needed when enabling automatic server discovery with PingDirectoryProxy. Multiple algorithms can be specified here, separated by a `;` character
FAIL_ON_DISABLED_BASE_DN	false	Set to true to fail the container if it is found that replication is not enabled for the USER_BASE_DN during startup. If replication is not enabled for the DN but this variable is not set to true, then a warning will be printed, but the container will not fail.
FAIL_ON_UNSUCCESSFUL_REMOVE_DEFUNCT	false	Set to true to fail the container if it is found that a previous call to remove-defunct-server in the hook scripts failed. If there was a failure but this variable is not set to true, then a warning will be printed, but the container will not fail. Failure of remove-defunct-server is marked by a file at ${SERVER_ROOT_DIR}/logs/remove-defunct-server-marker. Logs for the tool can be found at ${SERVER_ROOT_DIR}/logs/tools/remove-defunct-server.log
COLUMNS	120	Sets the number of columns in PingDirectory command-line tool output

BASE

${BASE:-/opt}

ROOT_USER

administrator

the default administrative user for PingData

JAVA_HOME

/opt/java

STAGING_DIR

${BASE}/staging

Path to the staging area where the remote and local server profiles can be merged

OUT_DIR

${BASE}/out

Path to the runtime volume

SERVER_ROOT_DIR

${OUT_DIR}/instance

Path from which the runtime executes

IN_DIR

${BASE}/in

Location of a local server-profile volume

SERVER_BITS_DIR

${BASE}/server

Path to the server bits

BAK_DIR

${BASE}/backup

Path to a volume generically used to export or backup data

LOGS_DIR

${BASE}/logs

Path to a volume generically used for logging

STAGING_MANIFEST

${BASE}/staging-manifest.txt

Path to a manifest of files expected in the staging dir on first image startup

CLEAN_STAGING_DIR

false

Whether to clean the staging dir when the container starts

SECRETS_DIR

/run/secrets

Default path to the secrets

TOPOLOGY_FILE

${STAGING_DIR}/topology.json

Path to the topology file

HOOKS_DIR

${STAGING_DIR}/hooks

Path where all the hooks scripts are stored

CONTAINER_ENV

${STAGING_DIR}/.env

Environment Property file use to share variables between scripts in container

SERVER_PROFILE_DIR

/tmp/server-profile

Path where the remote server profile is checked out or cloned before being staged prior to being applied on the runtime

SERVER_PROFILE_URL

A valid git HTTPS URL (not ssh)

SERVER_PROFILE_URL_REDACT

true

When set to "true", the server profile git URL will not be printed to container output.

SERVER_PROFILE_BRANCH

A valid git branch (optional)

SERVER_PROFILE_PATH

The subdirectory in the git repo

SERVER_PROFILE_UPDATE

false

Whether to update the server profile upon container restart

SECURITY_CHECKS_STRICT

false

Requires strict checks on security

SECURITY_CHECKS_FILENAME

*.jwk *.pin

Perform a check for filenames that may violate security (i.e. secret material)

UNSAFE_CONTINUE_ON_ERROR

If this is set to true, then the container will provide a hard warning and continue.

LICENSE_DIR

${SERVER_ROOT_DIR}

License directory

PD_LICENSE_DIR

${STAGING_DIR}/pd.profile/server-root/pre-setup

PD License directory. Separating from above LICENSE_DIR to differentiate for different products

STARTUP_FOREGROUND_OPTS

The command-line options to provide to the startup command when the container starts with the server in the foreground. This is the normal start flow for the container

STARTUP_BACKGROUND_OPTS

The command-line options to provide to the startup command when the container starts with the server in the background. This is the debug start flow for the container

PING_IDENTITY_DEVOPS_KEY_REDACT

true

PING_IDENTITY_ACCEPT_EULA

Legal requirement to explicitly accept the terms of the PingIdentity License Must be set to 'YES' for the container to start

PING_IDENTITY_DEVOPS_FILE

devops-secret

File name for devops-creds passed as a Docker secret

TAIL_LOG_FILES

A whitespace separated list of log files to tail to the container standard output - DO NOT USE WILDCARDS like /path/to/logs/*.log

COLORIZE_LOGS

true

If 'true', the output logs will be colorized with GREENs and REDs, otherwise, no colorization will be done. This is good for tools that monitor logs and colorization gets in the way.

LOCATION

Docker

Location default value If PingDirectory is deployed in multi cluster mode, that is, K8S_CLUSTER, K8S_CLUSTERS and K8S_SEED_CLUSTER are defined, LOCATION is ignored and K8S_CLUSTER is used as the location

LOCATION_VALIDATION

true

Validation toggle for LOCATION: true to require any string denoting a logical/physical location, false to disable the check

MAX_HEAP_SIZE

384m

Heap size (for java products)

JVM_TUNING

AGGRESSIVE

JAVA_RAM_PERCENTAGE

75.0

Percentage of the container memory to allocate to the JVM DO NOT set to 100% or your JVM will exit with OutOfMemory errors and the container will terminate

VERBOSE

false

Triggers verbose messages in scripts using the set -x option.

PING_DEBUG

false

Set the server in debug mode, with increased output

PING_PRODUCT

The name of Ping product, i.e. PingFederate, PingDirectory - must be a valid Ping product type. This variable should be overridden by child images.

PING_PRODUCT_VALIDATION

true

Validation toggle for PING_PRODUCT: true to require a valid Ping product type (e.g. PingFederate,PingDirectory), false to disable the check

ADDITIONAL_SETUP_ARGS

List of setup arguments passed to Ping Data setup-arguments.txt file

LDAP_PORT

1389

Port over which to communicate for LDAP

LDAPS_PORT

1636

Port over which to communicate for LDAPS

HTTPS_PORT

1443

Port over which to communicate for HTTPS

JMX_PORT

1689

Port for monitoring over JMX protocol

ORCHESTRATION_TYPE

The type of orchestration tool used to run the container, normally set in the deployment (.yaml) file. Expected values include: - compose - swarm - kubernetes Defaults to blank (i.e. No type is set)

USER_BASE_DN

dc=example,dc=com

Base DN for user data

DOLLAR

'$'

Variable with a literal value of '$', to avoid unwanted variable substitution

PD_ENGINE_PUBLIC_HOSTNAME

localhost

PD (PingDirectory) public hostname that may be used in redirects

PD_ENGINE_PRIVATE_HOSTNAME

pingdirectory

PD (PingDirectory) private hostname

PDP_ENGINE_PUBLIC_HOSTNAME

localhost

PDP (PingDirectoryProxy) public hostname that may be used in redirects

PDP_ENGINE_PRIVATE_HOSTNAME

pingdirectoryproxy

PDP (PingDirectoryProxy) private hostname

PDS_ENGINE_PUBLIC_HOSTNAME

localhost

PDS (PingDataSync) public hostname that may be used in redirects

PDS_ENGINE_PRIVATE_HOSTNAME

pingdatasync

PDS (PingDataSync) private hostname

PAZ_ENGINE_PUBLIC_HOSTNAME

localhost

PAZ (PingAuthorize) public hostname that may be used in redirects

PAZ_ENGINE_PRIVATE_HOSTNAME

pingauthorize

PAZ (PingAuthorize) private hostname

PAZP_ENGINE_PUBLIC_HOSTNAME

localhost

PAZP (PingAuthorize-PAP) public hostname that may be used in redirects

PAZP_ENGINE_PRIVATE_HOSTNAME

pingauthorizepap

PAZP (PingAuthorize-PAP) private hostname

PF_ENGINE_PUBLIC_HOSTNAME

localhost

PF (PingFederate) engine public hostname that may be used in redirects

PF_ENGINE_PRIVATE_HOSTNAME

pingfederate

PF (PingFederate) engine private hostname

PF_ADMIN_PUBLIC_BASEURL

https://localhost:9999

PF (PingFederate) admin public baseurl that may be used in redirects. PF_RUN_PF_ADMIN_BASEURL will override this value for PingFederate 11.3 and later.

PF_ADMIN_PUBLIC_HOSTNAME

localhost

PF (PingFederate) admin public hostname that may be used in redirects. PF_RUN_PF_ADMIN_HOSTNAME will override this value for PingFederate 11.3 and later.

PF_ADMIN_PRIVATE_HOSTNAME

pingfederate-admin

PF (PingFederate) admin private hostname

PA_ENGINE_PUBLIC_HOSTNAME

localhost

PA (PingAccess) engine public hostname that may be used in redirects

PA_ENGINE_PRIVATE_HOSTNAME

pingaccess

PA (PingAccess) engine private hostname

PA_ADMIN_PUBLIC_HOSTNAME

localhost

PA (PingAccess) admin public hostname that may be used in redirects

PA_ADMIN_PRIVATE_HOSTNAME

pingaccess-admin

PA (PingAccess) admin private hostname

ROOT_USER_DN

cn=${ROOT_USER}

DN of the server root user

ENV

${BASE}/.profile

PS1

\${PING_PRODUCT}:\h:\w\n>

Default shell prompt (i.e. productName:hostname:workingDir)

REGENERATE_JAVA_PROPERTIES

false

Whether to force a run of dsjavaproperties --initialize (false = only regenerate java.properties when the JVM or JVM options change)

PATH

${JAVA_HOME}/bin:${BASE}:${SERVER_ROOT_DIR}/bin:${PATH}

PATH used by the container

IMAGE_VERSION

${IMAGE_VERSION}

IMAGE_GIT_REV

${IMAGE_GIT_REV}

DATE

${DATE}

PING_PRODUCT_VERSION

${VERSION}

PING_PRODUCT

PingDirectory

Ping product name

LICENSE_DIR

${PD_LICENSE_DIR}

PD License directory (staged PingData profile pre-setup, where the PD license is placed by the staging hooks)

LICENSE_FILE_NAME

PingDirectory.lic

Name of license File

LICENSE_SHORT_NAME

Short name used when retrieving license from License Server

LICENSE_VERSION

${LICENSE_VERSION}

Version used when retrieving license from License Server

REPLICATION_PORT

8989

Default PingDirectory Replication Port

ADMIN_USER_NAME

admin

Replication administrative user

STARTUP_COMMAND

${SERVER_ROOT_DIR}/bin/start-server

The command that the entrypoint will execute in the foreground to instantiate the container

PD_DELEGATOR_PUBLIC_HOSTNAME

localhost

Public hostname of the DA app

STARTUP_FOREGROUND_OPTS

--nodetach

The command-line options to provide to the startup command when the container starts with the server in the foreground. This is the normal start flow for the container

STARTUP_BACKGROUND_OPTS

The command-line options to provide to the startup command when the container starts with the server in the background. This is the debug start flow for the container

ROOT_USER_PASSWORD_FILE

Location of file with the root user password (i.e. cn=directory manager). Defaults to /SECRETS_DIR/root-user-password

ADMIN_USER_PASSWORD_FILE

Location of file with the admin password, used as the password replication admin Defaults to /SECRETS_DIR/admin-user-password

ENCRYPTION_PASSWORD_FILE

Location of file with the passphrase for setting up encryption Defaults to /SECRETS_DIR/encryption-password

KEYSTORE_FILE

Location of the keystore file containing the server certificate. If left undefined, the SECRETS_DIR will be checked for a keystore. If that keystore does not exist, the server will generate a self-signed certificate.

KEYSTORE_PIN_FILE

Location of the pin file for the keystore defined in KEYSTORE_FILE. You must specify a KEYSTORE_PIN_FILE when a KEYSTORE_FILE is present. This value does not need to be defined when allowing the server to generate a self-signed certificate.

KEYSTORE_TYPE

Format of the keystore defined in KEYSTORE_FILE. One of "jks", "pkcs12", "pem", or "bcfks" (in FIPS mode). If not defined, the keystore format will be inferred based on the file extension of the KEYSTORE_FILE, defaulting to "jks".

TRUSTSTORE_FILE

Location of the truststore file for the server. If left undefined, the SECRETS_DIR will be checked for a truststore. If that truststore does not exist, the server will generate a truststore, containing its own certificate.

TRUSTSTORE_PIN_FILE

Location of the pin file for the truststore defined in TRUSTSTORE_FILE. You must specify a TRUSTSTORE_PIN_FILE when a TRUSTSTORE_FILE is present. This value does not need to be defined when allowing the server to generate a truststore.

TRUSTSTORE_TYPE

Format of the truststore defined in TRUSTSTORE_FILE. One of "jks", "pkcs12", "pem", or "bcfks" (in FIPS mode). If not defined, the truststore format will be inferred based on the file extension of the TRUSTSTORE_FILE, defaulting to "jks".

TAIL_LOG_FILES

${SERVER_ROOT_DIR}/logs/access ${SERVER_ROOT_DIR}/logs/errors ${SERVER_ROOT_DIR}/logs/failed-ops ${SERVER_ROOT_DIR}/logs/config-audit.log ${SERVER_ROOT_DIR}/logs/debug-trace ${SERVER_ROOT_DIR}/logs/debug-aci ${SERVER_ROOT_DIR}/logs/tools/*.log* ${SERVER_BITS_DIR}/logs/tools/*.log*

Files tailed once container has started

MAKELDIF_USERS

Number of users to auto-populate using make-ldif templates

RETRY_TIMEOUT_SECONDS

180

The default retry timeout in seconds for dsreplication and remove-defunct-server

PD_PROFILE

${STAGING_DIR}/pd.profile

Directory for the profile used by the PingData manage-profile tool

FIPS_MODE_ON

false

Turns on FIPS mode (currently with the Bouncy Castle FIPS provider) set to exactly "true" lowercase to turn on set to anything else to turn off

FIPS_PROVIDER

BCFIPS

BCFIPS is the only provider currently supported — do not edit

PD_REBUILD_ON_RESTART

false

Force a rebuild (replace-profile) of a PingDirectory on restart. Used to ensure that the server configuration exactly matches the server profile. This variable will slow down startup times and should only be used when necessary.

UNBOUNDID_SKIP_START_PRECHECK_NODETACH

true

Setting this variable to true speeds up server startup time by skipping an unnecessary JVM check.

REPLICATION_BASE_DNS

Base DNs to include when enabling replication, in addition to the always-included USER_BASE_DN. Multiple base DNs can be specified here, separated by a ; character

RESTRICTED_BASE_DNS

Base DNs to set as --restricted when enabling replication. Multiple base DNs can be specified here, separated by a ; character. See the product documentation for more information on how to configure entry balancing.

PARALLEL_POD_MANAGEMENT_POLICY

false

Whether this container is running as a Pod in a Kubernetes StatefulSet, and that StatefulSet is using the Parallel podManagementPolicy. This property allows for starting up Pods in parallel to speed up the initial startup of PingDirectory topologies. This variable must be set to true when using the Parallel podManagementPolicy. Note: when using parallel startup, ensure the RETRY_TIMEOUT_SECONDS variable is large enough. The pods will be enabling replication simultaneously, so some pods will have to retry while waiting for others to complete. If the timeout is too low, a Pod may end up restarting unnecessarily.

SKIP_WAIT_FOR_DNS

false

Set to true to skip the waiting for DNS step that is normally done just before attempting to join the topology.

CERTIFICATE_NICKNAME

There is an additional certificate-based variable used to identity the certificate alias used within the KEYSTORE_FILE. That variable is called CERTIFICATE_NICKNAME, which identifies the certificate to use by the server in the KEYSTORE_FILE. If a value is not provided, the container will look at the list certs found in the KEYSTORE_FILE and if one - and only one - certificate is found of type PrivateKeyEntry, that alias will be used.

PD_FORCE_DATA_REIMPORT

false

Set to true to force PingDirectory to export and re-import its backend data on restart. Note that this process can take a long time for large backends.

LOAD_BALANCING_ALGORITHM_NAMES

The load-balancing algorithm names to set for this server instance. This variable is only needed when enabling automatic server discovery with PingDirectoryProxy. Multiple algorithms can be specified here, separated by a ; character

FAIL_ON_DISABLED_BASE_DN

false

Set to true to fail the container if it is found that replication is not enabled for the USER_BASE_DN during startup. If replication is not enabled for the DN but this variable is not set to true, then a warning will be printed, but the container will not fail.

FAIL_ON_UNSUCCESSFUL_REMOVE_DEFUNCT

false

Set to true to fail the container if it is found that a previous call to remove-defunct-server in the hook scripts failed. If there was a failure but this variable is not set to true, then a warning will be printed, but the container will not fail. Failure of remove-defunct-server is marked by a file at ${SERVER_ROOT_DIR}/logs/remove-defunct-server-marker. Logs for the tool can be found at ${SERVER_ROOT_DIR}/logs/tools/remove-defunct-server.log

COLUMNS

120

Sets the number of columns in PingDirectory command-line tool output

Ports Exposed

The following ports are exposed from the container. If a variable is used, then it may come from a parent container

${LDAP_PORT}
${LDAPS_PORT}
${HTTPS_PORT}
${JMX_PORT}

Running a PingDirectory container

The easiest way to test a simple standalone image of PingDirectory is to cut/paste the following command into a terminal on a machine with docker.

  docker run \
           --name pingdirectory \
           --publish 1389:1389 \
           --publish 8443:1443 \
           --detach \
           --env SERVER_PROFILE_URL=https://github.com/pingidentity/pingidentity-server-profiles.git \
           --env SERVER_PROFILE_PATH=getting-started/pingdirectory \
           --env PING_IDENTITY_ACCEPT_EULA=YES \
           --env PING_IDENTITY_DEVOPS_USER \
           --env PING_IDENTITY_DEVOPS_KEY \
           --tmpfs /run/secrets \
           pingidentity/pingdirectory:edge

You can view the Docker logs with the command:

  docker logs -f pingdirectory

You should see the output from a PingDirectory install and configuration, ending with a message the PingDirectory has started. After it starts, you will see some typical access logs. Simply Ctrl-C after to stop tailing the logs.

Running a sample 100/sec search rate test

With the PingDirectory running from the previous section, you can run a searchrate job that will send load to the directory at a rate of 100/sec using the following command.

docker exec -it pingdirectory \
        /opt/out/instance/bin/searchrate \
                -b dc=example,dc=com \
                --scope sub \
                --filter "(uid=user.[1-9])" \
                --attribute mail \
                --numThreads 2 \
                --ratePerSecond 100

Connecting with an LDAP Client

Connect an LDAP Client (such as Apache Directory Studio) to this container using the default ports and credentials

LDAP Port	1389
	LDAP Base DN
dc=example,dc=com
Root Username	cn=administrator
	Root Password
2FederateM0re

LDAP Port

1389

LDAP Base DN

dc=example,dc=com

Root Username

cn=administrator

Root Password

2FederateM0re

Stopping/Removing the container

To stop the container:

  docker container stop pingdirectory

To remove the container:

  docker container rm -f pingdirectory

Docker Container Hook Scripts

Please go here for details on all pingdirectory hook scripts

This document is auto-generated from pingdirectory/Dockerfile