Use a specific journey

This page shows how to authenticate with SSO and the example AM authentication journey (tree) instead of the default authentication journey.

Set up the example in Use the default journey.

Add the following route to PingGateway:

Linux
Windows

$HOME/.openig/config/routes/sso-authservice.json

%appdata%\OpenIG\config\routes\sso-authservice.json

{
  "name": "sso-authservice",
  "baseURI": "http://app.example.com:8081",
  "condition": "${find(request.uri.path, '^/home/sso-authservice')}",
  "heap": [
    {
      "name": "SystemAndEnvSecretStore-1",
      "type": "SystemAndEnvSecretStore"
    },
    {
      "name": "AmService-1",
      "type": "AmService",
      "config": {
        "agent": {
          "username": "ig_agent",
          "passwordSecretId": "agent.secret.id"
        },
        "secretsProvider": "SystemAndEnvSecretStore-1",
        "url": "http://am.example.com:8088/openam/"
      }
    }
  ],
  "handler": {
    "type": "Chain",
    "config": {
      "filters": [
        {
          "name": "SingleSignOnFilter-1",
          "type": "SingleSignOnFilter",
          "config": {
            "amService": "AmService-1",
            "authenticationService": "Example"
          }
        }
      ],
      "handler": "ReverseProxyHandler"
    }
  }
}

Notice the features of the route compared to sso.json:

The route matches requests to /home/sso-authservice.
The authenticationService property of SingleSignOnFilter refers to Example, the name of the example authentication tree in AM. This authentication tree is used for authentication instead of the AM admin UI.

Test the setup:
1. In your browser’s privacy or incognito mode, go to https://ig.example.com:8443/home/sso-authservice.
2. If you see warnings that the site isn’t secure, respond to the warnings to access the site.
3. Note that the login page is different from Use the default journey.

PingGateway 2024.11

Use a specific journey