Managing environments - PingCentral

All environments managed within , as well as connected and environments, display on the Environments page, where you can view and update information about each environment and delete them from when they are no longer needed.

Items worth mentioning:

If you add environments to , ensure that is configured as the token provider. See Configuring PingFederate as a PingAccess token provider for details.
To enforce random secret generation and restrict non-administrators from creating their own, select the Generate Client Secret on Promotion check box when managing your environments. will generate random client secrets.
If your application owners promote applications to or environments, ensure that the appropriate trusted certificates are available in . See Adding trusted CA certificates to PingCentral for details.
Note:
Starting with 1.8, trusted CA certificates are stored in the database instead of an external trust store. Certificates that exist in this trust store in previous versions are imported to the database during the upgrade process.

Adding environments

Use the wizard to add and environments to .

Ensure that is configured as a token provider for .

For more information, see Configuring PingFederate as a PingAccess token provider.

On the Environments page, click Add Environment.
On the Connect to Instances page, connect to a or environment:
- To connect to a environment, complete the PingFederate Admin, PingFederate Admin Username, and PingFederate Admin Password fields with your authentication information.
- To connect to a environment, complete the PingAccess Admin, PingAccess Admin Username, and PingAccess Admin Password fields with your authentication information.
Note:
If an environment is disabled or offline, you will be unable to add the environment to .

If this is the first time that you have set up this environment, and the initial validation fails, you see a Skip Verification option. If you select this option, it allows you to skip the validation process. However, if you set it up correctly, you won't see this option.

If the environment is disabled or offline, and you edit the connection configuration, the Skip Verification check box is automatically marked.
Click Next.
On the Name Environment page, complete the Name, Short Code, and Description fields.
Optional: To configure whether non-administrators need approval for promoting an application to an environment, select an option from the Approval Type list:
- Select No Approval to allow non-administrators to promote applications to the environment freely.
- Select Approval Required to indicate that application promotion requires approval.
- Select Require Approval If Any Expression Fails and proceed to the next step to configure an Approval Expression.
- Select Require Approval If Any Expression Succeeds and proceed to the next step to configure an Approval Expression.
Optional: If you selected Require Approval If Any Expression Fails or Require Approval If Any Expression Succeeds, you must configure a Spring Expression Language (SpEL) expression in the Approval Expression field.

You can use SpEL expressions to determine whether an application requires approval or not. For more information, see Creating and testing approval expressions at the bottom of this page for details.

Tip:
For more information on SpEL, see Spring Expression Language (SpEL) in the Spring Framework documentation.
Optional: If you want application owners to be able to edit the underlying application JSON when they promote their OAuth and SAML applications, select Allow JSON editing for application promotions.

Warning: Providing application owners with this ability can be risky, so it’s highly recommended that you require promotion requests to be approved. That way, you'll be able to compare the submitted application JSON to the original application JSON before you approve the promotion.
Optional: To enforce random secret generation and restrict non-administrators from creating their own, select the Enforce Random Client Secrets check box.

will generate random client secrets.
Optional: Select the Allow only administrators to delete applications from PingFederate (and PingAccess, when applicable), option to restrict application owners from deleting applications from environments.
Optional: To add an certificate, select the appropriate certificate in the Signing Certificate list or to upload your own certificate, click Choose and enter the certificate password in the appropriate field. Click Save and Close.

The environment is displayed on the Environments page. If you chose to protect the environment, you see a shield icon next to its name. Depending on the type of environment, you also see a PF or PA icon. The color of this icon represents the status of the environment. A green icon indicates that the environment is verified while a red icon indicates that the environment isn't verified.

Depending on if an environment is online, offline, or disabled, you see the environment status in a display bar. You also see the toggle switch that you can click to disable the environment and indicate that it is undergoing maintenance.
Click Save and Continue.
Click the expandable icon associated with the environment to view environment details.
Environment details include:
- A link to PingFederate.
- A link to PingAccess.
- A description of the environment.
- The total number of applications hosted on this environment and a breakdown of or clients, connections, and applications. Click these links to access filtered lists of these applications on the Applications page.
  Note:
  If an environment is unavailable, applications in that environment don't display on the Applications page.

Updating environments

Update and environment information at any time.

To manage the environment maintenance status, see the following choices:
- To indicate that an environment is down for maintenance, toggle the switch on the applicable environment status bar from left (green) to right (gray). This action signals to application owners that the environment is undergoing maintenance and is now Disabled. This prevents from connecting to the environment, avoiding UI errors.
- To revert maintenance status, toggle the switch on the applicable environment status bar from right (gray) to left (green). This action removes the maintenance Disabled status, allowing application owners to resume interactions with the environment. This is the default status.
Note:
If an environment is offline or Disabled, the environment information displays a gray OFFLINE status bar. If an environment status is unknown, the status bar is unavailable.

To edit environment information, click the expandable icon associated with it, and then click the Pencil icon.

All of the editable information displays on one page.

Option	Description
Update the name and description	To update the name and description, change the information in the Name, Short Code, and Description fields.
Update the assertion encryption certificate	To update the assertion encryption certificate, click Choose to upload a new certificate and enter the certificate password in the appropriate field.
Update connection information	To update the connection information for either a PingFederate or PingAccess environment, change the information in the Username and Password fields. Note: If a environment is added to and removed through the edit page, the connection information is saved and restored if the environment is selected again.
Configure promotion approval requirements	To configure if non-administrators need approval for promoting an application to an environment, select an option from the Approval Type. Choose from: Select No Approval to allow non-administrators to promote applications to the environment freely. Select Approval Required to indicate that application promotion requires approval. Select Require Approval If Any Expression Fails and see Creating and testing approval expressions at the bottom of this page for details. Select Require Approval If Any Expression Succeeds and go to Creating and testing approval expressions on this page.
Update the JSON editing option	If you want application owners to be able to edit the underlying application JSON when they promote their OAuth and SAML applications, select Allow JSON editing for application promotions. Warning: Providing application owners with this ability can be risky, so it’s highly recommended that you require promotion requests to be approved. That way, you'll be able to compare the submitted application JSON to the original application JSON before you approve the promotion.
Add or remove the enforcement of random client secret generation	To enforce random secret generation and restrict non-administrators from creating their own, select the Enforce Random Client Secrets check box. will generate random client secrets. To allow non-administrators to generate their own secret, clear the check box.
Configure application owner deletion access	To restrict application owners from deleting applications from environments, select the Allow only administrators to delete applications from PingFederate (and PingAccess, when applicable), option.
Update the signing certificate	To update the signing certificate used to promote SAML applications, select the appropriate certificate in the Signing Certificate list or upload your own.
Update the SP certificate	To update the certificate, click Choose to upload a new certificate and enter the certificate password in the appropriate field.
Update the assertion encryption certificate	To update the assertion encryption certificate, click Choose to upload a new certificate and enter the certificate password in the appropriate field.

Click Save.

Deleting environments

Delete environments from when they are no longer needed.

Click the expandable icon associated with the environment to view environment details.
To delete the environment from , click its associated Delete icon.
A message displays asking you if you want to delete the environment.
Click Delete.
A message displays saying that the environment was deleted.
Note: When an environment is deleted, applications that were promoted to that environment retain the promotion details from the deleted environment.

Creating and testing approval expressions

Configure a Spring Expression Language (SpEL) expression to manage promotion approval requirements for your environment.

When you configure an environment, on the Connection page, select Require Approval If Any Expression Fails or Require Approval If Any Expression Succeeds from the Approval Expression list. For more information, see Adding environments.

You can use SpEL expressions to determine whether an application requires approval or not. For more information on SpEL, see Spring Expression Language (SpEL) in the Spring Framework documentation.

Tip: The approval expression should handle different application types and the promotional configurations associated with each application type.

On the Connection page, in the Approval Expression field, click Test to expand the Test Spring Expression window.
The Test Spring Expression window displays.
In the Application Configuration field, enter the available application configuration.
Optional: In the Promotion Configuration field, enter the promotion configuration corresponding to the provided application configuration.
Under the Spring Expression field, click Test Expression to test your SpEL expression.

Note: The API expects the application and promotion configuration to be a JSON payload.
The Spring Expression result displays.
For information about approval expression handling, see the following:
- If you selected Require Approval If Any Expression Fails from the Approval Type list: If any expression results in false then approval is required. If all expressions are true then approval is not required.
- If you selected Require Approval If Any Expression Succeeds from the Approval Type list: If any expression results in true then approval is required. If all expressions are false then approval is not required.
- If any of the expressions do not return a Boolean value or if there are any errors in the expressions, the promotions will require approval.
- Multiple expressions can be added, and are evaluated sequentially from top to bottom in an IF/ELSE chain. You can change the order in which these expressions display in the list by dragging and dropping them into different locations within the list.
Click the Update button to save your configuration or click the Cancel button to discard it.

Managing environments - PingCentral - 2.0

PingCentral for IAM Administrators

Adding environments

Updating environments

Deleting environments

Creating and testing approval expressions