--- title: Getting started for architects and deployers description: Help architects and deployers plan PingAM deployments by understanding capabilities, setting service levels, determining services and sizing, and planning topology component: pingam version: 7.5 page_id: pingam:deployment-planning:deploy-highlevel-start canonical_url: https://docs.pingidentity.com/pingam/8.1/deployment-planning/deploy-highlevel-start.html llms_txt: https://docs.pingidentity.com/pingam/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md keywords: ["deployment", "planning", "sla", "training", "security"] page_aliases: ["deployment-planning-guide:deploy-highlevel-start.adoc"] superseded_by: https://docs.pingidentity.com/pingam/8.1/deployment-planning/deploy-highlevel-start.html --- # Getting started for architects and deployers * **Learn about AM**. You can access online information, meet with your ForgeRock Sales representative, go to a seminar, or call ForgeRock about AM's capabilities. The following are some general questions that you may want to have answered: **Initial questions** | Initial tasks | Done ? | | | ------------------------------------------------------------------- | ------ | - | | Understand the access management problems that AM helps to solve | Y | N | | Learn how to protect a website with AM | Y | N | | Get to know the AM software deliverables | Y | N | | Get to know the tools for administering AM | Y | N | | Get to know the APIs for AM client applications | Y | N | | Find out how to get help and support from ForgeRock and partners | Y | N | | Find out how to get training from ForgeRock and partners | Y | N | | Find out how to keep up to date on new development and new releases | Y | N | | Find out how to report problems | Y | N | * **Set up a demo or pilot**. View an AM demo or set up a pilot to determine how you want to use AM to protect your site(s). ForgeRock Sales representatives can assist you with a demo or pilot. * **Attend a training class**. ForgeRock presents effective training classes to deploy AM in your environment. See [ForgeRock University](https://www.forgerock.com/services/university-training) for more information. * **Complete the accreditation program**. Complete the product-specific ForgeRock Accreditation Program to gain in-depth design and deployment expertise or seek partners who are ForgeRock Accredited Partners. * **Determine your service level agreements**. ForgeRock provides a set of standard service level agreements that you can sign up for. ForgeRock also provides custom service level agreements if the standard set doesn't meet your needs. **Standard SLAs** | Priority | Gold | Silver | Bronze | | ----------- | ----------------- | ----------------- | ----------------- | | Urgent (P1) | 2 Hour | 4 Hour | Next Business Day | | High (P2) | 4 Hour | 8 Hour | 2 Business Days | | Normal (P3) | 6 Hour | Next Business Day | 3 Business Days | | Low (P4) | Next Business Day | 2 Business Days | 4 Business Days | * **Determine your services**. ForgeRock provides a full, proven-production Identity Management stack to meet your requirements. **Services** | Services task | Done ? | | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | - | | Understand the services AM software provides | Y | N | | Determine which services to deploy | Y | N | | Determine which services the deployment consumes (load balancing, application container, authentication services, configuration storage, profile storage, token/session storage, policy storage, log storage) | Y | N | | Determine which services the deployment provides (SSO, CDSSO, SAML Federation IDP/SP, XACML PDP, REST STS, OAuth 2.0/OpenID Connect 1.0, and so forth) | Y | N | | Determine which resources AM protects (who consumes AM services) | Y | N | * **Determine your deployment objectives**. AM provides proven performance and security in many production deployments. You should determine your overall deployment objectives. **Deployment Objectives** | Deployment objectives | Done ? | | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------ | - | | Define deployment objectives in terms of service levels (expectations for authentication rates, active sessions maintained, session life cycles, policies managed, authorization decision rates, response times, throughput, and so forth) | Y | N | | Define deployment objectives in terms of service availability (AM service availability, authentication availability, authorization decision availability, session availability, elasticity) | Y | N | | Understand how AM services scale for high availability | Y | N | | Understand the restrictions in an AM deployment that uses client-side sessions | Y | N | | Plan for availability (number of sites and servers, load balancing and AM software configuration) | Y | N | | Define the domains managed and domains involved in the deployment | Y | N | | Define deployment objectives for delegated administration | Y | N | | Agree with partners for federated deployments on circles of trust and terms | Y | N | * **Plan sizing**. At this stage, you should determine the sizing estimates for your deployment. ForgeRock Sales Engineers can assist you in this task. **Sizing** | Sizing | Done ? | | | ------------------------------------------------------------------------------------------------------- | ------ | - | | Derive sizing estimates from service levels and availability | Y | N | | Understand how to test sizing estimates (load generation tools?) | Y | N | | Size servers for AM deployment: CPU | Y | N | | Size servers for AM deployment: Memory | Y | N | | Size servers for AM deployment: Network | Y | N | | Size servers for AM deployment: I/O | Y | N | | Size servers for AM deployment: Storage | Y | N | | Quantify impact on external services consumed (LDAP, other auth services, load balancing, and so forth) | Y | N | | Plan testing and acceptance criteria for sizing | Y | N | * **Plan the topology**. Plan your logical and physical deployment. **Topology Planning** | Topology | Done ? | | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | - | | Specify the logical and physical deployment topology (show examples of each) | Y | N | | Determine how many external stores you need (configuration, CTS, application, policy, UMA…​) | Y | N | | Plan installation of AM services (including external dependencies) | Y | N | | Plan installation of AM web and Java agents, Fedlets, and PingGateway (might be done by partner service providers) | Y | N | | Plan integration with client applications | Y | N | | Plan customization of AM (UI, user profile attributes, authentication modules, identity repositories, OAuth 2.0 scope handling, OAuth 2.0 response types, post-authentication actions, policy evaluation, session quota exhaustion actions, policy evaluation, identity data storage, AM service, custom logger, custom policy enforcement points or agents). | Y | N | * **Plan security**. At this stage, you must plan how to secure your deployment. **Security** | Security | Done ? | | | ---------------------------------------------------------------------------------------------------------------------------- | ------ | - | | Understand security guidelines, including legal requirements | Y | N | | Change default settings and administrative user credentials | Y | N | | Protect service ports (Firewall, Dist Auth UI, reverse proxy) | Y | N | | Turn off unused service endpoints | Y | N | | Separate administrative access from client access | Y | N | | Secure communications (HTTPS, LDAPS, secure cookies, cookie hijacking protection, key management for signing and encryption) | Y | N | | Determine if components handle SSL acceleration or termination | Y | N | | Securing processes and files (e.g. with SELinux, dedicated non-privileged user and port forwarding, and so forth) | Y | N | * **Post-deployment tasks**. At this stage, you should plan your post-deployment tasks to sustain and monitor your system. **Post-deployment Tasks** | Post deployment tasks | Done ? | | | ---------------------------------------------------------------------------------------------------- | ------ | - | | Plan administration following AM deployment (services, agents/PingGateway, delegated administration) | Y | N | | Plan monitoring following deployment | Y | N | | Plan how to expand the deployment | Y | N | | Plan how to upgrade the deployment | Y | N |