Install the Platform admin UI for standalone IDM

Download the Platform admin UI artifact (PingIDM-Admin-UI-8.1.1.zip) from the Backstage download site.

Extract the .zip archive to a working directory:

unzip ~/Downloads/PingIDM-Admin-UI-8.1.1.zip -d ~/Downloads/tmp

IDMAdminUI/
├── www/
│   └── platform/             # Production build output
├── Dockerfile                # Production image (Nginx + Alpine)
├── nginx.conf                # Example config for standalone Nginx
├── nginx.docker.conf         # Example config for Docker
├── entrypoint.sh             # Container entrypoint
├── variable_replacement.sh   # envsubst script for static assets
└── DEPLOYMENT.md

Change to the extracted directory:

cd ~/Downloads/tmp/IDMAdminUI

Set the environment variables for your deployment. The variable_replacement.sh script substitutes these values into the compiled JavaScript bundles. The following defaults assume IDM is reachable through the same Nginx host:

export IDM_REST_URL=/openidm
export IDM_UPLOAD_URL=/upload
export IDM_EXPORT_URL=/export
export MENUS_FILE=menus.idm
export ROUTES_FILE=routes.idm
export DEPLOYMENT_TYPE=IDM
export ENABLE_WORKFORCE=false
export AM_URL=
export AM_ADMIN_URL=

Run the variable replacement script against the compiled JavaScript:

./variable_replacement.sh www/platform/js/*.js

Install Nginx using the package manager for your operating system. For example:

sudo apt update
sudo apt install nginx

sudo yum install nginx

Copy the UI assets into the Nginx html webroot:

cp -r www/platform /usr/share/nginx/html/

Edit the nginx.conf file from the extracted archive:

...
server {
    listen       8082;        (1)
    server_name  localhost;

    root /usr/share/nginx/html;
    ...
    location /openidm {
        proxy_pass http://localhost:8080/openidm;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Copy the modified nginx.conf to the Nginx configuration directory:

cp ~/Downloads/tmp/IDMAdminUI/nginx.conf /etc/nginx/nginx.conf

Test the modified nginx.conf configuration for syntax errors:

nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Restart Nginx:

systemctl restart nginx

Change to the extracted directory:

cd ~/Downloads/tmp/IDMAdminUI

From the extracted archive, build the image.

docker build -t platform-admin-ui:latest .

docker build \
  --build-arg WEB_ROOT_LOCATION=my/assets \
  --build-arg NGINX_CONF=my-nginx.conf \
  -t platform-admin-ui:latest .

Run the container, passing your environment variables as -e flags. For the full list of supported variables and defaults, refer to Environment variables reference.

docker run -d --name idm-admin -p 8082:8080 \
  -e IDM_REST_URL="/openidm" \
  -e IDM_UPLOAD_URL="/upload" \
  -e IDM_EXPORT_URL="/export" \
  -e MENUS_FILE="menus.idm" \
  -e ROUTES_FILE="routes.idm" \
  -e DEPLOYMENT_TYPE="IDM" \
  -e ENABLE_WORKFORCE="false" \
  -e AM_URL="" \
  -e AM_ADMIN_URL="" \
  platform-admin-ui:latest

To use your own Nginx server block instead of the one built into the image, mount it over default.conf at runtime:

docker run -d -p 8082:8080 \
  -v /path/to/my-nginx.conf:/etc/nginx/conf.d/default.conf:ro \
  platform-admin-ui:latest

In PingOne, create an OIDC Web App application. This application is distinct from the resource used for token introspection on the IDM side.

Set the Token Endpoint Authentication Method to None.

Add your local UI to the Redirect URIs field and enable the Allow Redirect URI Patterns checkbox. This lets you use a wildcard pattern in the redirect URI, for example, http://localhost:8082/*. Learn more about Redirect URIs.

Add the resource you created when you set up PingOne to the web application you created in step 1.

Create a user in PingOne. This is the user who signs on to the Platform admin UI. Make sure it matches the identity you mapped in staticUserMapping in Configure the rsFilter.

Collect the following values from your PingOne application:

Set the corresponding environment variables described in Environment variables reference: ADMIN_CLIENT_ID, AUTHORIZATION_ENDPOINT, TOKEN_ENDPOINT, REVOCATION_ENDPOINT, and END_SESSION_ENDPOINT.