Completing the installation

Regardless of whether you are installing Delegated Admin in a Unix, Linux, or Windows environment, perform the relevant steps in this section after you complete the previous OS-specific tasks.

Navigate to the type of installation you want to complete for the relevant steps.

For all installation types, you must configure the Delegated Admin host to include the following response header in all responses sent back from the Delegated Admin application: X-Frame-Options: SAMEORIGIN. This header protects your server and the Delegated Admin application from clickjacking attacks.

PingDirectoryProxy server

Before you begin

The following task assumes that when you ran the setup command, you answered y to the question Is Delegated Admin being installed in a topology containing PingDirectoryProxy?

To configure the PingDirectoryProxy server:

Steps

Apply the commands from the delegated-admin-for-proxy.dsconfig batch file to the PingDirectoryProxy server where you’re installing Delegated Admin.

Example:

$ ./bin/dsconfig \
  --bindDN "cn=Directory Manager" \
  --bindPassword <password> \
  --no-prompt \
  --batch-file webapps/delegator/delegated-admin-for-proxy.dsconfig

Next steps

You must also configure all PingDirectory instances using the delegated-admin.dsconfig script as described in PingDirectory server.

External web server

Before you begin

The following steps assume that when you ran the setup command, you answered n to the question Will the web app be hosted in PingDirectory?

Steps

Open config.js in a text editor.
Change the variable values to specify the location of the PingDirectory server.

config.jsVariable Value

window.DS_HOST

Host name of the PingDirectory server

window.DS_PORT

HTTPS port of the PingDirectory server

To view an example outline that features these settings, see example.config.js.
Save your changes to config.js.

config.jsVariable	Value
`window.DS_HOST`	Host name of the PingDirectory server
`window.DS_PORT`	HTTPS port of the PingDirectory server

Create a CORS policy for the Delegated Admin HTTP servlet extension, where <origin> represents the public name of the host, proxy, or load balancer that presents the Delegated Admin web application.

Example:

dsconfig create-http-servlet-cross-origin-policy
  --policy-name "Delegated Admin Cross-Origin Policy"
  --set "cors-allowed-methods: GET"
  --set "cors-allowed-methods: OPTIONS"
  --set "cors-allowed-methods: POST"
  --set "cors-allowed-methods: DELETE"
  --set "cors-allowed-methods: PATCH"
  --set "cors-allowed-origins: <origin>"

dsconfig set-http-servlet-extension-prop
  --extension-name "Delegated Admin"
  --set "cross-origin-policy:Delegated Admin Cross-Origin Policy"

(Optional) If you will be enabling administrators to run Delegated Admin reports in your configuration, run dsconfig with the set-http-servlet-cross-origin-policy-prop option.

Example:
```
dsconfig set-http-servlet-cross-origin-policy-prop \
  --policy-name "Delegated Admin Cross-Origin Policy" \
  --set cors-exposed-headers:Content-Disposition
```

Next steps

You must also configure any PingDirectory servers in the topology using the delegated-admin.dsconfig script as described in PingDirectory server.

PingDirectory server

To continue installing Delegated Admin on a PingDirectory server, or to complete the installation for an external web server or PingDirectoryProxy:

Steps

Select the appropriate PingDirectory installation type:

Choose from:

For single instances of PingDirectory, run the following command on the PingDirectory server:

$ ./bin/dsconfig \
  --bindDN "cn=Directory Manager" \
  --bindPassword <password> \
  --no-prompt \
  --batch-file webapps/delegator/delegated-admin.dsconfig

For replicated instances of the PingDirectory server, run the following command on each PingDirectory server instance in the replication topology:

$ ./bin/dsconfig \
  --bindDN "cn=Directory Manager" \
  --bindPassword <password> \
  --no-prompt \
  --batch-file webapps/delegator/delegated-admin.dsconfig \
  --applyChangeTo server-group

Next steps

You can’t sign on to Delegated Admin until you configure the rights of the delegated administrators. Learn more about configuring administrative rights, the REST resource type, session timeout values, and other properties in Configuring Delegated Admin.

After you configure Delegated Admin, verify that the application is installed and working successfully.