--- title: UI and API access description: This page describes the legacy CDM implementation, which will be deprecated in an upcoming release. We strongly recommend that you transition to the current CDM implementation as soon as possible. component: forgeops version: 7.2 page_id: forgeops::legacy/cdm/access canonical_url: https://docs.pingidentity.com/forgeops/7.2/legacy/cdm/access.html section_ids: legacy-am-services-cdm: AM services idm_services: IDM Services ds_command_line_access: DS command-line access legacy-cdm-monitoring: CDM monitoring grafana: Grafana prometheus: Prometheus next_step: Next step --- # UI and API access | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | This page describes the legacy CDM implementation, which will be deprecated in an upcoming release. We strongly recommend that you transition to [the current CDM implementation](../../cdm/overview.html) as soon as possible. | This page shows you how to access and monitor the Ping Identity Platform components that make up the CDM. AM and IDM are configured for access through the CDM cluster's Kubernetes ingress controller. You can access these components using their admin UIs and REST APIs. DS cannot be accessed through the ingress controller, but you can use Kubernetes methods to access the DS pods. For more information about how AM and IDM have been configured in the CDM, see [Configuration](https://github.com/ForgeRock/forgeops/blob/release/7.2-20240117/README.md#configuration) in the `forgeops` repository's top-level README file for more information about the configurations. ## AM services To access the AM admin UI: 1. Make sure that the `prod` namespace is the active namespace in your local Kubernetes context. 2. Obtain the `amadmin` user's password: ``` $ cd /path/to/forgeops/bin $ ./forgeops info | grep amadmin vr58qt11ihoa31zfbjsdxxrqryfw0s31 (amadmin user) ``` 3. Open a new window or tab in a web browser. 4. Go to . The Kubernetes ingress controller handles the request, routing it to the `login-ui` pod. The login UI prompts you to log in. 5. Log in as the `amadmin` user. The Ping Identity Platform UI appears in the browser. 6. Select Native Consoles > Access Management. The AM admin UI appears in the browser. To access the AM REST APIs: 1. Start a terminal window session. 2. Run a curl command to verify that you can access the REST APIs through the ingress controller. For example: ``` $ curl \ --insecure \ --request POST \ --header "Content-Type: application/json" \ --header "X-OpenAM-Username: amadmin" \ --header "X-OpenAM-Password: vr58qt11ihoa31zfbjsdxxrqryfw0s31" \ --header "Accept-API-Version: resource=2.0" \ --data "{}" \ "https://prod.iam.example.com/am/json/realms/root/authenticate" { "tokenId":"AQIC5wM2…​", "successUrl":"/am/console", "realm":"/" } ``` ## IDM Services To access the IDM admin UI: 1. Make sure that the `prod` namespace is the active namespace in your local Kubernetes context. 2. Obtain the `amadmin` user's password: ``` $ cd /path/to/forgeops/bin $ ./forgeops info | grep amadmin vr58qt11ihoa31zfbjsdxxrqryfw0s31 (amadmin user) ``` 3. Open a new window or tab in a web browser. 4. Go to . The Kubernetes ingress controller handles the request, routing it to the `login-ui` pod. The login UI prompts you to log in. 5. Log in as the `amadmin` user. The Ping Identity Platform UI appears in the browser. 6. Select Native Consoles > Identity Management. The IDM admin UI appears in the browser. To access the IDM REST APIs: 1. Start a terminal window session. 2. If you haven't already done so, get the `amadmin` user's password using the forgeops info command. 3. AM authorizes IDM REST API access using the [OAuth 2.0 authorization code flow](https://docs.pingidentity.com/pingam/7.2/oauth2-guide/oauth2-authz-grant.html). The CDM comes with the `idm-admin-ui` client, which is configured to let you get a bearer token using this OAuth 2.0 flow. You'll use the bearer token in the next step to access the IDM REST API: 1. Get a session token for the `amadmin` user: ``` $ curl \ --request POST \ --insecure \ --header "Content-Type: application/json" \ --header "X-OpenAM-Username: amadmin" \ --header "X-OpenAM-Password: vr58qt11ihoa31zfbjsdxxrqryfw0s31" \ --header "Accept-API-Version: resource=2.0, protocol=1.0" \ 'https://prod.iam.example.com/am/json/realms/root/authenticate' { "tokenId":"AQIC5wM. . .TU3OQ*", "successUrl":"/am/console", "realm":"/"} ``` 2. Get an authorization code. Specify the ID of the session token that you obtained in the previous step in the `--Cookie` parameter: ``` $ curl \ --dump-header - \ --insecure \ --request GET \ --Cookie "iPlanetDirectoryPro=AQIC5wM. . .TU3OQ*" \ "https://prod.iam.example.com/am/oauth2/realms/root/authorize?redirect_uri=https://prod.iam.example.com/platform/appAuthHelperRedirect.html&client_id=idm-admin-ui&scope=openid%20fr:idm:*&response_type=code&state=abc123" HTTP/2 302 server: nginx/1.17.10 date: Mon, 10 May 2021 16:54:20 GMT content-length: 0 location: https://prod.iam.example.com/platform/appAuthHelperRedirect.html ?code=3cItL9G52DIiBdfXRngv2_dAaYM&iss=http://prod.iam.example.com:80/am/oauth2&state=abc123 &client_id=idm-admin-ui set-cookie: route=1595350461.029.542.7328; Path=/am; Secure; HttpOnly x-frame-options: SAMEORIGIN x-content-type-options: nosniff cache-control: no-store pragma: no-cache set-cookie: OAUTH_REQUEST_ATTRIBUTES=DELETED; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=/; HttpOnly; SameSite=none strict-transport-security: max-age=15724800; includeSubDomains x-forgerock-transactionid: ee1f79612f96b84703095ce93f5a5e7b ``` 3. Exchange the authorization code for an access token. Specify the access code that you obtained in the previous step in the `code` URL parameter: ``` $ curl --request POST \ --insecure \ --data "grant_type=authorization_code" \ --data "code=3cItL9G52DIiBdfXRngv2_dAaYM" \ --data "client_id=idm-admin-ui" \ --data "redirect_uri=https://prod.iam.example.com/platform/appAuthHelperRedirect.html" \ "https://prod.iam.example.com/am/oauth2/realms/root/access_token" { "access_token":"oPzGzGFY1SeP2RkI-ZqaRQC1cDg", "scope":"openid fr:idm:*", "id_token":"eyJ0eXAiOiJKV . . . sO4HYqlQ", "token_type":"Bearer", "expires_in":239 } ``` 4. Run a curl command to verify that you can access the `openidm/config` REST endpoint through the ingress controller. Use the access token returned in the previous step as the bearer token in the authorization header. The following example command provides information about the IDM configuration: ``` $ curl \ --insecure \ --request GET \ --header "Authorization: Bearer oPzGzGFY1SeP2RkI-ZqaRQC1cDg" \ --data "{}" \ https://prod.iam.example.com/openidm/config { "_id":"", "configurations": [ { "_id":"ui.context/admin", "pid":"ui.context.4f0cb656-0b92-44e9-a48b-76baddda03ea", "factoryPid":"ui.context" }, . . . ] } ``` ## DS command-line access The DS pods in the CDM are not exposed outside of the cluster. If you need to access one of the DS pods, use a standard Kubernetes method: * Execute shell commands in DS pods using the kubectl exec command. * Forward a DS pod's LDAPS port (1636) to your local computer. Then, you can run LDAP CLI commands, for example ldapsearch. You can also use an LDAP editor such as Apache Directory Studio to access the directory. For all CDM directory pods, the directory superuser DN is `uid=admin`. Obtain this user's password by running the **forgeops info** command. ## CDM monitoring This section describes how to access Grafana dashboards and Prometheus UI. ### Grafana To access Grafana dashboards: 1. Set up port forwarding on your local computer for port 3000: ``` $ /path/to/forgeops/bin/prometheus-connect.sh -G Forwarding from 127.0.0.1:3000 → 3000 Forwarding from [::1]:3000 → 3000 ``` 2. In a web browser, navigate to http\://localhost:3000 to access the Grafana dashboards. 3. Log in as the `admin` user with `password` as the password. When you're done using the Grafana UI, enter Ctrl+c in the terminal window where you initiated port forwarding. For information about Grafana, see [the Grafana documentation](http://docs.grafana.org). ### Prometheus To access the Prometheus UI: 1. Set up port forwarding on your local computer for port 9090: ``` $ /path/to/forgeops/bin/prometheus-connect.sh -P Forwarding from 127.0.0.1:9090 → 9090 Forwarding from [::1]:9090 → 9090 ``` 1. In a web browser, navigate to http\://localhost:9090 to access the Prometheus UI. When you're done using the Prometheus UI, enter Ctrl+c in the terminal window where you initiated port forwarding. For information about the Prometheus, see [the Prometheus documentation](https://prometheus.io/docs/introduction/overview). For a description of the CDM monitoring architecture and information about how to customize CDM monitoring, see [CDM monitoring](../../how-to/monitoring/overview.html). ## Next step * [icon: check-square-o, set=fa][Become familiar with the CDM](intro.html) * [icon: check-square-o, set=fa][Understand CDM architecture](architecture.html) * [icon: check-square-o, set=fa][Set up your local environment and create a cluster](setup-cdm.html) * [icon: check-square-o, set=fa][Deploy the platform](deploy.html) * [icon: check-square-o, set=fa][Access platform UIs and APIs](#) * [icon: square-o, set=fa]*[Plan for production deployment](next-steps.html)*