The Platform UIs send a request to the AM Authorization Endpoint.

If the end user is authenticated, the user agent is redirected back to the UI, according to the Redirection URI request parameter.

If the end user is not authenticated, the AM Authorization Endpoint redirects the user agent to the Platform Login UI.

After successful authentication, the Platform Login UI redirects the user agent back to the AM Authorization Endpoint, according to the GoTo request parameter.

Unpack the DS files you downloaded.

Generate and save a unique DS deployment ID:

/path/to/opendj/bin/dskeymgr create-deployment-id --deploymentIdPassword password

export DEPLOYMENT_ID=deployment-id

Install a DS server with the necessary setup profiles:

/path/to/opendj/setup \
--deploymentId $DEPLOYMENT_ID \
--deploymentIdPassword password \
--rootUserDN uid=admin \
--rootUserPassword str0ngAdm1nPa55word \
--monitorUserPassword str0ngMon1torPa55word \
--hostname directory.example.com \
--adminConnectorPort 4444 \
--ldapPort 1389 \
--enableStartTls \
--ldapsPort 1636 \
--profile am-config \
--set am-config/amConfigAdminPassword:5up35tr0ng \
--profile am-cts \
--set am-cts/amCtsAdminPassword:5up35tr0ng \
--set am-cts/tokenExpirationPolicy:am-sessions-only \
--profile am-identity-store \
--set am-identity-store/amIdentityStoreAdminPassword:5up35tr0ng \
--acceptLicense

Start the DS server:

/path/to/opendj/bin/start-ds

Follow the instructions in the AM documentation to prepare your environment.

Use a supported version of Apache Tomcat as the web application container:

Create a new directory that will house a dedicated truststore for AM:

mkdir -p /path/to/openam-security/

Export the DS server certificate.

/path/to/opendj/bin/dskeymgr export-ca-cert \
--deploymentId $DEPLOYMENT_ID \
--deploymentIdPassword password \
--outputFile ds-ca-cert.pem

Import the DS server certificate into the dedicated AM truststore.

keytool \
-importcert \
-trustcacerts \
-alias ds-ca-cert \
-file /path/to/ds-ca-cert.pem \
-keystore /path/to/openam-security/truststore \
-storepass changeit \
-storetype JKS
Owner: CN=Deployment key, O=ForgeRock.com
Issuer: CN=Deployment key, O=ForgeRock.com
...
Trust this certificate? [no]:  yes
Certificate was added to keystore

List the certificates in the new truststore and verify that the certificate you added is there:

keytool \
-list \
-keystore /path/to/openam-security/truststore \
-storepass changeit

Point Apache Tomcat to the path of the new truststore so that AM can access it.

CATALINA_OPTS="-Djavax.net.ssl.trustStore=/path/to/openam-security/truststore \
-Djavax.net.ssl.trustStorePassword=changeit \
-Djavax.net.ssl.trustStoreType=jks"

Verify secure authentication to the DS server with the dedicated AM accounts.

/path/to/opendj/bin/ldapsearch \
--hostname directory.example.com \
--port 1636 \
--useSsl \
--useJavaTrustStore /path/to/openam-security/truststore \
--trustStorePassword changeit \
--bindDn uid=am-config,ou=admins,ou=am-config \
--bindPassword 5up35tr0ng \
--baseDn ou=am-config \
"(&)" \
1.1
dn: ou=am-config

dn: ou=admins,ou=am-config

dn: uid=am-config,ou=admins,ou=am-config

/path/to/opendj/bin/ldapsearch \
--hostname directory.example.com \
--port 1636 \
--useSsl \
--useJavaTrustStore /path/to/openam-security/truststore \
--trustStorePassword changeit \
--bindDn uid=am-identity-bind-account,ou=admins,ou=identities \
--bindPassword 5up35tr0ng \
--baseDn ou=identities \
"(&)" \
1.1
dn: ou=identities

dn: ou=people,ou=identities

dn: ou=groups,ou=identities

dn: ou=admins,ou=identities

dn: uid=am-identity-bind-account,ou=admins,ou=identities

Follow the instructions in the AM documentation to download AM. Make sure you download the .zip file, not just the .war file.

Copy the AM .war file to deploy in Apache Tomcat as am.war:

cp AM-7.5.0.war /path/to/tomcat/webapps/am.war

Start Tomcat if it is not already running.

Navigate to the deployed AM application; for example, http://am.example.com:8081/am/.

Select Create New Configuration to create a custom configuration.

Accept the license agreement, and click Continue.

Set a password for the default user, amAdmin.

On the Server Settings screen, enter your AM server settings; for example:

On the Configuration Data Store Settings screen, select External DS, and enter the details for the DS instance that you set up as a configuration store.

On the User Data Store Settings screen, select External User Data Store, and enter the details for the DS instance that you set up as an identity store.

On the Site Configuration screen, select No, then click Next.

Review the Configurator Summary Details, then click Create Configuration.

Log in to the AM admin UI as the amAdmin user.

Browse to Configure > Server Defaults > CTS.

Make the following changes, saving your work before switching tabs:

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

Click + New Realm, and create the new realm with the following settings:

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

In the Top Level Realm, configure an idm-resource-server client to introspect access tokens:

In the Top Level Realm and the alpha realm, configure identical idm-provisioning clients to make calls to IDM:

In the Top Level Realm and the alpha realm, configure identical idm-admin-ui clients that will be used by the Platform Admin UI:

In the Top Level Realm and the alpha realm, configure identical end-user-ui clients that will be used by the Platform End User UI:

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

Configure a provider for the Top Level Realm:

Configure a provider for the alpha realm:

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

From the top menu, select Configure > Global Services > IDM Provisioning.

Set the following fields:

Click Save Changes.

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

In the alpha realm, select Services, and click Add a Service.

Under Choose a service type, select Validation Service.

For Valid goto URL Resources, add the URLs for the Platform UI:

Click Create.

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

From the top menu, select Configure > Global Services > CORS Service.

On the Secondary Configurations tab, click Add a Secondary Configuration.

On the New Configuration screen, enter the following values:

Click Create.

On the Cors Configuration screen, set the following values:

Click Save Changes.

Extract the sample-trees-7.5.0.zip file, and list the sample trees in the root/AuthTree directory:

ls /path/to/openam-samples/root/AuthTree
Agent.json                         PlatformForgottenUsername.json
Example.json                       PlatformLogin.json
Facebook-ProvisionIDMAccount.json  PlatformProgressiveProfile.json
Google-AnonymousUser.json          PlatformRegistration.json
Google-DynamicAccountCreation.json PlatformResetPassword.json
HmacOneTimePassword.json           PlatformUpdatePassword.json
PersistentCookie.json              RetryLimit.json

In all the sample tree files, replace "realm" : "/" with "realm" : "/alpha".

Download and install Amster.

Start Amster, then connect to your AM instance:

./amster
Amster OpenAM Shell (version build build, JVM: version)
Type ':help' or ':h' for help.
---------------------------------------------------------------------------
am> connect --interactive http://am.example.com:8081/am
Sign in
User Name: amAdmin
Password: Passw0rd
amster am.example.com:8081> :exit

Import the sample authentication trees and nodes:

amster am.example.com:8081>import-config --path /path/to/openam-samples/root
Importing directory /path/to/openam-samples/root/AcceptTermsAndConditions
...
Import completed successfully

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

Configure the PlatformRegistration tree:

Configure the PlatformLogin tree:

Configure the PlatformResetPassword tree:

Configure the PlatformUpdatePassword tree:

For the authentication trees that require email, set the External Login Page URL.

In the alpha realm, select Services, and click Add a Service.

Under Choose a service type, select Self Service Trees, and click Create.

Add the following tree mappings:

Click Save Changes.

Unpack the DS files you downloaded.

Generate and save a unique DS deployment ID:

/path/to/opendj/bin/dskeymgr create-deployment-id --deploymentIdPassword password

export DEPLOYMENT_ID=deployment-id

Install a DS server with the necessary setup profiles:

/path/to/opendj/setup \
--deploymentId $DEPLOYMENT_ID \
--deploymentIdPassword password \
--rootUserDN uid=admin \
--rootUserPassword str0ngAdm1nPa55word \
--monitorUserPassword str0ngMon1torPa55word \
--hostname directory.example.com \
--adminConnectorPort 4444 \
--ldapPort 1389 \
--enableStartTls \
--ldapsPort 1636 \
--profile am-config \
--set am-config/amConfigAdminPassword:5up35tr0ng \
--profile am-cts \
--set am-cts/amCtsAdminPassword:5up35tr0ng \
--set am-cts/tokenExpirationPolicy:am-sessions-only \
--profile am-identity-store \
--set am-identity-store/amIdentityStoreAdminPassword:5up35tr0ng \
--profile idm-repo \
--set idm-repo/domain:forgerock.io \
--acceptLicense

Start the DS server:

/path/to/opendj/bin/start-ds

Follow the instructions in the AM documentation to prepare your environment.

Use a supported version of Apache Tomcat as the web application container:

Create a new directory that will house a dedicated truststore for AM:

mkdir -p /path/to/openam-security/

Export the DS server certificate.

/path/to/opendj/bin/dskeymgr export-ca-cert \
--deploymentId $DEPLOYMENT_ID \
--deploymentIdPassword password \
--outputFile ds-ca-cert.pem

Import the DS server certificate into the dedicated AM truststore.

keytool \
-importcert \
-trustcacerts \
-alias ds-ca-cert \
-file /path/to/ds-ca-cert.pem \
-keystore /path/to/openam-security/truststore \
-storepass changeit \
-storetype JKS
Owner: CN=Deployment key, O=ForgeRock.com
Issuer: CN=Deployment key, O=ForgeRock.com
...
Trust this certificate? [no]:  yes
Certificate was added to keystore

List the certificates in the new truststore and verify that the certificate you added is there:

keytool \
-list \
-keystore /path/to/openam-security/truststore \
-storepass changeit

Point Apache Tomcat to the path of the new truststore so that AM can access it.

CATALINA_OPTS="-Djavax.net.ssl.trustStore=/path/to/openam-security/truststore \
-Djavax.net.ssl.trustStorePassword=changeit \
-Djavax.net.ssl.trustStoreType=jks"

Verify secure authentication to the DS server with the dedicated AM accounts.

/path/to/opendj/bin/ldapsearch \
--hostname directory.example.com \
--port 1636 \
--useSsl \
--useJavaTrustStore /path/to/openam-security/truststore \
--trustStorePassword changeit \
--bindDn uid=am-config,ou=admins,ou=am-config \
--bindPassword 5up35tr0ng \
--baseDn ou=am-config \
"(&)" \
1.1
dn: ou=am-config

dn: ou=admins,ou=am-config

dn: uid=am-config,ou=admins,ou=am-config

/path/to/opendj/bin/ldapsearch \
--hostname directory.example.com \
--port 1636 \
--useSsl \
--useJavaTrustStore /path/to/openam-security/truststore \
--trustStorePassword changeit \
--bindDn uid=am-identity-bind-account,ou=admins,ou=identities \
--bindPassword 5up35tr0ng \
--baseDn ou=identities \
"(&)" \
1.1
dn: ou=identities

dn: ou=people,ou=identities

dn: ou=groups,ou=identities

dn: ou=admins,ou=identities

dn: uid=am-identity-bind-account,ou=admins,ou=identities

Follow the instructions in the AM documentation to download AM. Make sure you download the .zip file, not just the .war file.

Copy the AM .war file to deploy in Apache Tomcat as am.war:

cp AM-7.5.0.war /path/to/tomcat/webapps/am.war

Start Tomcat if it is not already running.

Navigate to the deployed AM application; for example, http://am.example.com:8081/am/.

Select Create New Configuration to create a custom configuration.

Accept the license agreement, and click Continue.

Set a password for the default user, amAdmin.

On the Server Settings screen, enter your AM server settings; for example:

On the Configuration Data Store Settings screen, select External DS, and enter the details for the DS instance that you set up as a configuration store.

On the User Data Store Settings screen, select External User Data Store, and enter the details for the DS instance that you set up as an identity store.

On the Site Configuration screen, select No, then click Next.

Review the Configurator Summary Details, then click Create Configuration.

Log in to the AM admin UI as the amAdmin user.

Browse to Configure > Server Defaults > CTS.

Make the following changes, saving your work before switching tabs:

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

Click + New Realm, and create the new realm with the following settings:

In the alpha realm, select Identity Stores then click OpenDJ.

On the Server Settings tab, set LDAPv3 Plug-in Search Scope to SCOPE_ONE, then click Save Changes.

On the User Configuration tab, set LDAP Users Search Attribute to fr-idm-uuid, then click Save Changes.

On the Authentication Configuration tab, check that the Authentication Naming Attribute is set to uid, then click Save Changes.

In the Top Level Realm, under Identity Stores, delete the configuration for OpenDJ.

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

In the Top Level Realm, configure an idm-resource-server client to introspect access tokens:

In the Top Level Realm and the alpha realm, configure identical idm-provisioning clients to make calls to IDM:

In the Top Level Realm and the alpha realm, configure identical idm-admin-ui clients that will be used by the Platform Admin UI:

In the Top Level Realm and the alpha realm, configure identical end-user-ui clients that will be used by the Platform End User UI:

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

Configure a provider for the Top Level Realm:

Configure a provider for the alpha realm:

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

From the top menu, select Configure > Global Services > IDM Provisioning.

Set the following fields:

Click Save Changes.

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

In the alpha realm, select Services, and click Add a Service.

Under Choose a service type, select Validation Service.

For Valid goto URL Resources, add the URLs for the Platform UI:

Click Create.

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

From the top menu, select Configure > Global Services > CORS Service.

On the Secondary Configurations tab, click Add a Secondary Configuration.

On the New Configuration screen, enter the following values:

Click Create.

On the Cors Configuration screen, set the following values:

Click Save Changes.

Extract the sample-trees-7.5.0.zip file, and list the sample trees in the root/AuthTree directory:

ls /path/to/openam-samples/root/AuthTree
Agent.json                         PlatformForgottenUsername.json
Example.json                       PlatformLogin.json
Facebook-ProvisionIDMAccount.json  PlatformProgressiveProfile.json
Google-AnonymousUser.json          PlatformRegistration.json
Google-DynamicAccountCreation.json PlatformResetPassword.json
HmacOneTimePassword.json           PlatformUpdatePassword.json
PersistentCookie.json              RetryLimit.json

In all the sample tree files, replace "realm" : "/" with "realm" : "/alpha".

Download and install Amster.

Start Amster, then connect to your AM instance:

./amster
Amster OpenAM Shell (version build build, JVM: version)
Type ':help' or ':h' for help.
---------------------------------------------------------------------------
am> connect --interactive http://am.example.com:8081/am
Sign in
User Name: amAdmin
Password: Passw0rd
amster am.example.com:8081> :exit

Import the sample authentication trees and nodes:

amster am.example.com:8081>import-config --path /path/to/openam-samples/root
Importing directory /path/to/openam-samples/root/AcceptTermsAndConditions
...
Import completed successfully

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

Configure the PlatformRegistration tree:

Configure the PlatformLogin tree:

Configure the PlatformResetPassword tree:

Configure the PlatformUpdatePassword tree:

For the authentication trees that require email, set the External Login Page URL.

In the alpha realm, select Services, and click Add a Service.

Under Choose a service type, select Self Service Trees, and click Create.

Add the following tree mappings:

Click Save Changes.

Save a password file for the keystore:

mkdir -p /path/to/security/
touch /path/to/security/keystore.pin
chmod 600 /path/to/security/keystore.pin
echo -n password > /path/to/security/keystore.pin

Set the deployment ID in an environment variable that you will use in dskeymgr commands:

export DEPLOYMENT_ID=deployment-id

Generate a server key pair for IG to use for HTTPS:

/path/to/opendj/bin/dskeymgr \
 create-tls-key-pair \
 --deploymentId $DEPLOYMENT_ID \
 --deploymentIdPassword password \
 --keyStoreFile /path/to/security/keystore \
 --keyStorePassword:file /path/to/security/keystore.pin \
 --hostname localhost \
 --hostname platform.example.com \
 --subjectDn CN=platform.example.com,O=ForgeRock

Inspect the contents of the keystore you just created to find the key alias is ssl-key-pair:

keytool -list -keystore /path/to/security/keystore -storepass:file /path/to/security/keystore.pin
Keystore type: PKCS12
Keystore provider: SUN

Your keystore contains 1 entry

ssl-key-pair, <date>, PrivateKeyEntry,
Certificate fingerprint (SHA-256): <fingerprint>

Copy the keystore and password to the system where IG runs.

Export the deployment ID CA certificate to trust:

/path/to/opendj/bin/dskeymgr \
export-ca-cert \
--deploymentId $DEPLOYMENT_ID \
--deploymentIdPassword password \
--outputFile ca-cert.pem

Download IG-2024.3.0.zip.

Unpack the files.

Create a configuration directory for IG:

mkdir -p $HOME/.openig/config/

Add an admin.json configuration file for HTTPS support at the root of the IG configuration directory.

{
    "heap": [
        {
            "name": "TlsConf",
            "type": "ServerTlsOptions",
            "config": {
                "keyManager": {
                    "type": "SecretsKeyManager",
                    "config": {
                        "signingSecretId": "key.manager.secret.id",
                        "secretsProvider": "ServerIdentityStore"
                    }
                }
            }
        },
        {
            "name": "SecretsPasswords",
            "type": "FileSystemSecretStore",
            "config": {
                "directory": "/path/to/security/",
                "format": "PLAIN"
            }
        },
        {
            "name": "ServerIdentityStore",
            "type": "KeyStoreSecretStore",
            "config": {
                "file": "/path/to/security/keystore",
                "storePasswordSecretId": "keystore.pin",
                "secretsProvider": "SecretsPasswords",
                "mappings": [
                    {
                        "secretId": "key.manager.secret.id",
                        "aliases": [
                            "ssl-key-pair"
                        ]
                    }
                ]
            }
        }
    ],
    "connectors": [
        {
            "port": 9080
        },
        {
            "port": 9443,
            "tls": "TlsConf"
        }
    ]
}

Start IG:

/path/to/identity-gateway-2024.3bin/start.sh
...
[main] INFO ... started in XXXXms on ports : [9080, 9443]

Test that you can use the IG "ping" endpoint over HTTP:

curl -v http://platform.example.com:9080/openig/ping

When you can successfully ping IG over HTTP, try HTTPS using your CA certificate file:

curl -v --cacert ca-cert.pem https://platform.example.com:9443/openig/ping

Add a config.json configuration file at the root of the IG configuration directory.

{
    "heap": [
        {
            "name": "capture",
            "type": "CaptureDecorator"
        },
        {
            "name": "DefaultRoute",
            "type": "StaticResponseHandler",
            "config": {
                "status": 200,
                "headers": {
                    "Content-Type": [
                        "text/html"
                    ]
                },
                "entity": "<html><p><a href='/enduser-login/?realm=/alpha#/service/PlatformLogin'>End user access</a></p><p><a href='/platform-login/?realm=/#/'>Admin access</a></p></html>"
            }
        },
        {
            "type": "Router",
            "name": "_router",
            "config": {
                "defaultHandler": "DefaultRoute"
            }
        }
    ],
    "handler": "_router",
    "audit": "global"
}

Create a routes directory under the IG configuration file directory:

mkdir $HOME/.openig/config/routes

Add a login.json route file in the routes directory.

{
    "name": "login",
    "condition": "${find(request.uri.path, '^/enduser-login|^/platform-login')}",
    "baseURI": "http://login.example.com:8083",
    "handler": {
        "type": "Chain",
        "config": {
            "filters": [
                {
                    "type": "UriPathRewriteFilter",
                    "config": {
                        "mappings": {
                            "/enduser-login": "/",
                            "/platform-login": "/"
                        },
                        "failureHandler": "DefaultRoute"
                    }
                }
            ],
            "handler": "ReverseProxyHandler"
        }
    }
}

Add an enduser-ui.json route file in the routes directory.

{
    "name": "enduser-ui",
    "condition": "${find(request.uri.path, '^/enduser-ui')}",
    "baseURI": "http://enduser.example.com:8888",
    "handler": {
        "type": "Chain",
        "config": {
            "filters": [
                {
                    "type": "UriPathRewriteFilter",
                    "config": {
                        "mappings": {
                            "/enduser-ui": "/"
                        },
                        "failureHandler": "DefaultRoute"
                    }
                }
            ],
            "handler": "ReverseProxyHandler"
        }
    }
}

{
    "name": "enduser-ui",
    "condition": "${find(request.uri.path, '^/enduser-ui')}",
    "baseURI": "http://am.example.com:8081",
    "handler": {
        "type": "Chain",
        "config": {
            "filters": [
                {
                    "type": "UriPathRewriteFilter",
                    "config": {
                        "mappings": {
                            "/enduser-ui": "/enduser"
                        },
                        "failureHandler": "DefaultRoute"
                    }
                }
            ],
            "handler": "ReverseProxyHandler"
        }
    }
}

Add a platform-ui.json route file in the routes directory.

{
    "name": "platform-ui",
    "condition": "${find(request.uri.path, '^/platform-ui')}",
    "baseURI": "http://admin.example.com:8082",
    "handler": {
        "type": "Chain",
        "config": {
            "filters": [
                {
                    "type": "UriPathRewriteFilter",
                    "config": {
                        "mappings": {
                            "/platform-ui": "/"
                        },
                        "failureHandler": "DefaultRoute"
                    }
                }
            ],
            "handler": "ReverseProxyHandler"
        }
    }
}

{
    "name": "platform-ui",
    "condition": "${find(request.uri.path, '^/platform-ui')}",
    "baseURI": "http://am.example.com:8081",
    "handler": {
        "type": "Chain",
        "config": {
            "filters": [
                {
                    "type": "UriPathRewriteFilter",
                    "config": {
                        "mappings": {
                            "/platform-ui": "/platform"
                        },
                        "failureHandler": "DefaultRoute"
                    }
                }
            ],
            "handler": "ReverseProxyHandler"
        }
    }
}

Add an am.json route file in the routes directory.

{
    "name": "am",
    "baseURI": "http://am.example.com:8081",
    "condition": "${find(request.uri.path, '(?:^/am(?!/XUI))')}",
    "handler": {
        "type": "Chain",
        "config": {
            "filters": [
                {
                    "comment": "Always redirect to IG rather than AM",
                    "type": "LocationHeaderFilter",
                    "config": {
                        "baseURI": "https://platform.example.com:9443/"
                    }
                }
            ],
            "handler": "ReverseProxyHandler"
        }
    }
}

Add an idm.json route file in the routes directory.

{
    "name": "idm",
    "baseURI": "http://openidm.example.com:8080",
    "condition": "${find(request.uri.path, '(?:^/openidm)|(?:^/admin)|(?:^/upload)|(?:^/export)')}",
    "handler": {
        "type": "Chain",
        "config": {
            "filters": [
                {
                    "comment": "Always redirect to IG rather than IDM",
                    "type": "LocationHeaderFilter",
                    "config": {
                        "baseURI": "https://platform.example.com:9443/"
                    }
                }
            ],
            "handler": "ReverseProxyHandler"
        }
    }
}

Restart IG to take all your changes into account.

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

In the Top Level Realm and the alpha realm, add redirect URIs for the end-user-ui OAuth 2.0 client:

In the Top Level Realm and the alpha realm, add redirect URIs for the idm-admin-ui OAuth 2.0 client:

In the alpha realm, edit Success URLs for the following AM trees:

Update these settings:

Download the Docker images:

Create an environment file named platform_env that will be passed to the docker command.

AM_URL=https://platform.example.com:9443/am
AM_ADMIN_URL=https://platform.example.com:9443/am/ui-admin
IDM_REST_URL=https://platform.example.com:9443/openidm
IDM_ADMIN_URL=https://platform.example.com:9443/admin
IDM_UPLOAD_URL=https://platform.example.com:9443/upload
IDM_EXPORT_URL=https://platform.example.com:9443/export
ENDUSER_UI_URL=https://platform.example.com:9443/enduser-ui
PLATFORM_ADMIN_URL=https://platform.example.com:9443/platform-ui/
ENDUSER_CLIENT_ID=end-user-ui
ADMIN_CLIENT_ID=idm-admin-ui
THEME=default
PLATFORM_UI_LOCALE=en

SUBFOLDER=enduser

ENDUSER_UI_URL=http://ui.example.com:8888/enduser

Start each Docker container, specifying the environment file:

Get the UI .zip file, and unzip it into the tmp directory:

Replace URLs in the UI application with URLs for your ForgeRock Identity Platform deployment:

Install the UI:

Revise the AM and IDM configurations to work with the new UI installation:

If you’re not currently logged in to the AM admin UI as the amAdmin user, log in.

Under Scripts, find the OIDC Claims Script, and click to view the script.

Add a post_logout_url claim method to the array of claimAttributes.

claimAttributes = [
        //...,
        "post_logout_url": { claim, identity -> return [(claim.getName()): "https://forgerock.com"] }
]

Add the claim for the fr:idm:* scope as a final item in the scopeClaimsMap:

scopeClaimsMap = [
        //...,
        "fr:idm:*": [ "post_logout_url" ]
]

Click Validate, correct any errors accidentally introduced, and then click Save Changes.

Under Services > OAuth2 Provider, search for Always Return Claims in ID Tokens, then enable the option, and click Save Changes.

Test the changes you have made:

Upgrade the platform UIs.

Upgrade IG.

Upgrade DS.

Upgrade AM.

Upgrade IDM.

Get the current configuration for the Identity Platform admin UI using an administrator’s OAuth 2.0 access token.

curl \
 --header 'Authorization: Bearer <access-token>' \
 https://platform.example.com:9443/openidm/config/ui/configuration

Copy and edit the JSON to set the value of the boolean field, configuration > platformSettings > hosted-pages:

Replace the configuration with your updated copy:

curl \
 --request PUT \
 --header 'Authorization: Bearer <access-token>' \
 --data '<updated-configuration-json>'
 https://platform.example.com:9443/openidm/config/ui/configuration

Attempt to use the primary fr locale:

Fall back to the default en locale:

Select Hosted Pages > + New Theme.

Enter a theme name that describes the theme’s purpose; for example, the brand associated with an authentication journey.

Use the tabs and options to customize various aspects of the theme:

Select Journeys, then select the journey for the custom theme, and click Edit.

Click …​ > Edit Details then select Override theme.

Select the custom theme to apply, then click Save.