--- title: Change Dashboard default settings description: You can change the default settings of PingIntelligence for APIs Dashboard. component: pingintelligence version: 5.1 page_id: pingintelligence:pingintelligence_production_deployment:pingintelligence_changing_dashboard_default_settings canonical_url: https://docs.pingidentity.com/pingintelligence/5.1/pingintelligence_production_deployment/pingintelligence_changing_dashboard_default_settings.html revdate: March 22, 2024 section_ids: change-settings-in-dashboard-defaults-yml: Change settings in dashboard-defaults.yml change-settings-in-ilm-json: Change settings in ilm.json --- # Change Dashboard default settings You can change the default settings of PingIntelligence for APIs Dashboard. To change the default settings, edit the `dashboard-defaults.yml` file and `ilm.json` file. ## Change settings in dashboard-defaults.yml You can change the default settings of PingIntelligence Dashboard by editing the `//pingidentity/pi-api-deployment/config/dashboard-defaults.yml` file. The following table lists the variables that you can set for PingIntelligence Dashboard in various configurations. | Variable | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `port` | Port number to connect to PingIntelligence Dashboard. | | `authentication_mode` | Defines the mode in which Dashboard authenticates. The valid values are `native` and `sso`. You should use native authentication for proof-of-concept deployments. | | `session_max_age` | Defines the maximum time for a session. The configured values should be in the form of ``. Duration should be > 0. Allowed `duration_suffix` values: `m` for minutes, `h` for hours, and `d` for days. | | `max_active_sessions` | Defines the maximum number of active UI sessions at any given time. The value should be greater than 1. | | `admin_password` and `ping_user_password` | The passwords for webgui `admin` and `ping_user` accounts. admin\_password and ping\_user\_password are applicable in native authentication\_mode only. | | **Single sign-on (SSO) configurations** - Applicable only when `authentication_mode` is set as `sso` | | | `sso_oidc_client_id` | Client ID value in configured in the Identity provider. | | `sso_oidc_client_secret` | Client Secret configured for the corresponding Client ID. | | `sso_oidc_client_authentication_method` | OpenID Connect (OIDC) Client authentication mode. The valid values are `BASIC`, `POST`, or `NONE` | | `sso_oidc_provider_issuer_uri` | HTTPS IP address of OIDC provider. Also, place the SSO provider's issuer-certificate in the following path - `/pingidentity/certs/webgui/` | | `sso_oidc_provider_user_uniqueid_claim_name` | Claim name for unique ID of the user in UserInfo response. A new user is provisioned using this unique ID value. | | `sso_oidc_provider_user_first_name_claim_name` | Claim name for first name of the user in UserInfo response. Either first name or last name can be empty, but both should not be empty. | | `sso_oidc_provider_user_last_name_claim_name` | Claim name for last name of the user in UserInfo response. Either first name or last name can be empty, but both should not be empty. | | `sso_oidc_provider_user_role_claim_name` | Claim name for role of the user in UserInfo response. Default value is `role`. | | `sso_oidc_client_additional_scopes` | Additional scopes in authorization request. Multiple scopes should be comma (,) separated values. OpenID, profile scopes are always requested. | | -**End-of-SSO-configurations**- | | | SSL configuration for PingIntelligence Dashboard- `server_ssl_key_store_password` - `server_ssl_key_alias` | Configure the passwords for keystore and key alias. | | H2 database configuration:- `h2_db_password` - `h2_db_encryption_password` | Password for H2 database and password for encryption | | **Discovery configuration** - The following variables configure discovery settings for Dashboard:- `discovery_source` - `discovery_mode` - `discovery_mode_auto_polling_interval` - `discovery_mode_auto_delete_non_discovered_apis`**Discovery source** - Defines the details of discovery source for PingAccess or Axway API gateway.**PingAccess**- `pingaccess_url` - `pingaccess_username` - `pingaccess_password`**Axway**- `axway_url` - `axway_username` - `axway_password` | * `discovery_source` - Defines the source of discovered APIs. The discovery source can be `abs`, `pingaccess`, or `axway` * `discovery_mode` - Defines the mode in which Dashboard publishes APIs to ASE. It can either `auto` or `manual` mode. For more information on discovery mode, see[Discovered APIs](../pingintelligence_dashboard/pingintelligence_discovered_apis.html) * `discovery_mode_auto_polling_interval` - If the mode is set to `auto` in previous option, then configure the time interval in minutes for publishing the APIs to ASE. It recommended to keep a minimum time interval of 10 minutes. * `discovery_mode_auto_delete_non_discovered_apis` - If the mode is set to `auto`, you can configure whether you want to delete the other APIs from ASE when Dashboard publishes the discovered APIs.Configure PingAccess or Axway URL, username and password if the discovery source is `pingaccess` or `axway`. | | `enable_xpack` | Configures whether the deployment package installs X-pack. The default value is `true`. If you are using an existing Elasticsearch and authentication is not configured for Xpack, set `enable_xpack` to `false`. | | `elasticsearch_url` | If you have set `install_elasticsearch` as `false` in the `hosts` file, configure the Elasticsearch URL. Enter the complete URL including http/https. For example, . Providing the port number in the URL is mandatory. | | `elasticsearch_distro_type` | Configure the distribution type of Elasticsearch. Allowed values are `default` or `aws`. This variable is available for configuration in PingIntelligence for APIs 4.4.1. | | `elastic_username` | If you want to use an already available Elasticsearch username, configure it in `elastic_username`. | | `elastic_password` | Elasticsearch password. The default value is `changeme`. Do not change the elastic\_password after PingIntelligence installation is complete. | | `consumer_user` | Consumer user in Kafka.Default: `pi4api_de_user` | | `consumer_authentication_password` | Consumer user password.Default: `changeme` | | `dataengine_groupid` | Group in Kafka for data engine consumer.Default: `pi4api.data-engine` | | `ping_user_password` | Password for the default user name `ping_user`. | | `ping_admin_password` | Password for the admin. | | Syslog configuration:* `enable_syslog` * `host, port` * `facility` | Configure Syslog details.Setting `enable_syslog` to `true` lets dashboard engine log the ABS detected attacks in the `syslog` server.Provide the host and port number of syslog server. | | | | | - | --------------------------------------------------------------------------------------------------------------------------------- | | | Make sure to take a backup of the `dashboard-defaults.yml` file on a secure machine after the automated installation is complete. | The following is a sample `dashboard-defaults.yml` file. ``` --- webgui: # Define ports for PingIntelligence WebGUI # Make sure ports are not same for single server installation port: 8030 # allowed values: native, sso. # In native mode, webgui users are self managed and stored in webgui. # In sso mode, webgui users are managed and stored in an Identity provider. authentication_mode: native # Maximum duration of a session. # Value should be in the form of # Duration should be > 0. # Allowed duration_suffix values: m for minutes, h for hours, d for days. session_max_age: 6h # Number of active UI sessions at any time. # Value should be greater than 1. max_active_sessions: 50 admin_password and ping_user_password are applicable in native authentication_mode only. # webgui "admin" account password admin_password: changeme # webgui "ping_user" account password ping_user_password: changeme Below sso configuration properties are applicable in sso authentication_mode only. # Client ID value in Identity provider. sso_oidc_client_id: pingintelligence # Client Secret of the above Client ID. sso_oidc_client_secret: changeme # OIDC Client authentication mode. # Valid values: BASIC, POST, or NONE sso_oidc_client_authentication_method: BASIC # OIDC Provider uri # WebGUI queries /.well-known/openid-configuration to get OIDC provider metadata # issuer ssl certificate is not trusted by default. So import issuer ssl certificate into config/webgui.jks # issuer should be reachable from both back-end and front-end sso_oidc_provider_issuer_uri: https://127.0.0.1:9031 # Place the sso provider issuer-certificate in the following path => /pingidentity/certs/webgui/ # Name of the file should be => webgui-sso-oidc-provider.crt # claim name for unique id of the user in UserInfo response # a new user is provisioned using this unique id value sso_oidc_provider_user_uniqueid_claim_name: sub # claim name for first name of the user in UserInfo response # either first name or last name can be empty, but both should not be empty sso_oidc_provider_user_first_name_claim_name: given_name # claim name for last name of the user in UserInfo response # either first name or last name can be empty, but both should not be empty sso_oidc_provider_user_last_name_claim_name: family_name # claim name for role of the user in UserInfo response sso_oidc_provider_user_role_claim_name: role # additional scopes in authorization request # multiple scopes should be comma (,) separated # openid,profile scopes are always requested sso_oidc_client_additional_scopes: ## End of sso configuration # ssl key store password of webgui hosts server_ssl_key_store_password: changeme server_ssl_key_alias: webgui # local h2 db datasource properties h2_db_password: changeme h2_db_encryption_password: changeme # allowed values: abs/pingaccess/axway discovery_source: abs # allowed values: auto/manual discovery_mode: auto # value is in minutes discovery_mode_auto_polling_interval: 10 discovery_mode_auto_delete_non_discovered_apis: false # valid only if discovery_source is set to pingaccess pingaccess_url: https://127.0.0.1:9000/ pingaccess_username: Administrator pingaccess_password: # valid only if discovery_source is set to axway axway_url: https://127.0.0.1:8075/ axway_username: apiadmin axway_password: dataengine: ui: # Install elasticsearch with xpack enabled # If there is no authentication on pre-existing elasticsearch, set this to false enable_xpack: true server_port: 8040 # When install_elasticsearch is set to false in config/hosts, this url will be used # Give the complete url with https/http and elasticsearch port number # Make sure elasticsearch_url is accessible from ansible management host, dataengine, webgui nodes. elasticsearch_url: https://search-giueibohzd6pfijfysjfsxucty.pingidentity.com:443 # Configuration distribution type of elasticsearch. Allowed values are default or aws elasticsearch_distro_type: default # User with permission set similar to "elastic" user elastic_username: elastic # Passwords for "elasticsearch","ping_user" and "ping_admin" users # dataengine will be accessible for these accounts # Please set strong passwords # If enable_xpack is set to false, below passwords are ignored elastic_password: changeme # ssl key store password of webgui hosts server_ssl_key_store_password: changeme server_ssl_key_alias: dataengine #Users ,passowrd and groupid for dataengine in kafka consumer_user: pi4api_de_user consumer_authentication_password: changeme dataengine_groupid: pi4api.data-engine syslog: # Configuration for syslog enable_syslog: false host: localhost port: 614 facility: LOCAL0 ``` ## Change settings in ilm.json You can change the default settings of Index Lifecycle Management (ILM) policy by editing the `//pingidentity/pi-api-deployment/config/ilm.json` file. The ILM policy allows you to manage the lifecycle of the Elasticsearch indices. The following table lists the variables that you can set in the `ilm.json` file. For more information on`ilm.json` configuration, see [Automatic rollover index](../pingintelligence_dashboard/pingintelligence_automatic_rollover_index.html). | Variable | Description | | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `max_size` | Defines the maximum size of the Elasticsearch rollover index. When the index size reaches the defined value, it rolls over.`max_size` value should be a positive non-zero number. Allowed units are MB and GB. | | `max_age` | Defines the maximum age of the Elasticsearch rollover index configuration. `max_age` value should be a positive non-zero number. Allowed units are` h` for hours and `d` for the number of days. If both `max_size` and` max_age` are configured, then the index rolls over based on the value that is achieved first. | | `min_age` | Defines the minimum age, after which the Elasticsearch rollover index enters into a different phase. Allowed units are` h` for hours and `d` for the number of days. Every index starts from `hot` phase. For more information on the phases in an index life cycle, see [Automatic rollover index](../pingintelligence_dashboard/pingintelligence_automatic_rollover_index.html). | | `priority` | Defines the sequence in which, indices are reloaded back into memory when Elasticsearch restarts. Use a positive integer number to set the priority. | | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Rollover index configuration takes effect only when `enable_xpack` is set to` true`in`dashboard-default.yml` file. For more information, see [Change settings in dashboard-defaults.yml](pingintelligence_changing_settings_dashboard_defaults_yml.html). | The following is a sample `ilm.json` file. ```json { "policy": { "phases": { "hot": { "actions": { "rollover": { "max_size": "7GB", "max_age": "7d" }, "set_priority": { "priority": 100 } } }, "warm": { "min_age": "30d", "actions": { "set_priority": { "priority": 50 } } }, "cold": { "min_age": "90d", "actions": { "freeze": {}, "set_priority": { "priority": 0 } } } } } } ```