
PingFederate Demo: Applications, Adapter, and Configuration Archive
------------------------------------------------------------------------

Introduction
------------

The PingFederate demo is designed to configure the PingFederate 
server quickly to work with a simple example intended to demonstrate 
Web single sign-on (SSO) and single logout (SLO). The demo also provides 
configuration options and application features that point to the broad 
range of capabilities available for your identity-federation deployment.

Web application developers at your site can use the applications
contained in the demo as a starting point for implementing similar 
functionality at your site.


Setup/Installation
------------------

The PingFederate demo (located in the <PF_install>/pingfederate/demo 
directory) consists of:

- Two extracted WAR directories containing the IdP and SP demo 
  applications

- A data.zip file containing the PingFederate server configuration 
  necessary to support the demo

- A JAR file containing a non-production PingFederate adapter used 
  to integrate PingFederate with the demo applications

CAUTION: Deploying the data.zip file will overwrite any work you may 
have already done using the PingFederate administrative console. However,
if you wish to save this work, you can easily archive it before
deploying the demo and then restore it later. For more information, 
see the "System Administration" chapter in the PingFederate Administrator's 
Manual, located in the <PF_install>/pingfederate/docs directory.

To deploy the Demo:

1. If you have not already done so, complete the PingFederate server
   installation according to instructions in the Administrator's
   Manual and ensure that you've copied your license key to the
   <PF_install>/pingfederate/server/default/conf directory.

2. Copy the demo-app-sp.war and demo-app-ipp.war directories into the 
   <PF_install>/pingfederate/server/default/deploy directory.
  
   This step deploys the two demo Java Web applications into the servlet 
   container in PingFederate.

3. Copy the demo-reference-adapter-beta.jar file into the 
   <PF_install>/pingfederate/server/default/deploy directory.

4  Start the PingFederate server from the <PF_install>/pingfederate/bin 
   directory using the appropriate "run" script for your platform.

5. Copy the data.zip file in the <PF_install>/pingfederate/demo directory
   to the <PF-install>/pingfederate/server/default/data/drop-in-deployer 
   directory.
  
   This step uses PingFederate's configuration archive deployment 
   feature to set up the complete server configuration needed for the
   demo. (The file disappears from the deployment directory in a moment.)
  

Usage
-----

After the steps above are complete, you can use the demo applications to 
initiate SAML 2.0 SSO and SLO through the PingFederate server. 
You can use the demo applications for either SP- or IdP-intiated 
operations (for more information, see the "Supported Standards" chapter
in the Administrator's Manual).

To get started via the SP application:

1. Open a browser to the SP Welcome page at this location:
   https://localhost:9031/demo-app-sp/go 

2. To initiate SSO, click 'Single Sign-On'.

   You are redirected to IdP demo application.

3. On the Demo IdP Welcome page, enter 'test' as the user password.

   (Optionally, you can choose a different User Id: the password is the
   same for all users.)
   
   After you enter credentials, the IdP generates a SAML assertion and 
   sends it to the SP, where it is validated and processed. The 
   attribute values contained in the assertion are used to create a user
   session available to the SP demo application.

To get started via the IdP application:

1. Open a browser to the IdP Welcome page at this location:
   https://localhost:9031/demo-app-idp/go

2. Enter 'test' as the user password.

3. Click 'Single Sign-On'.

   You are logged on to the SP demo application (by a process similar
   to that described above for SP-initiated SSO).

Other SSO, SLO, and attribute-exchange scenarios are possible with 
the demos and should be self-explanatory by navigating around the 
various options presented by the applications (but see 'Limitations" 
below).

Console output and system log files show the actual SAML protocol 
messages exchanged and processed. The log files are located in the 
<PF_install>/pingfederate/logs directory.

To better understand the demo and learn more about PingFederate 
features, you can access the administrative console and review the
configuration. (You can click the Help link on any screen or
consult the Administrator's Manual for more information as you go.) 

To access the console:

1. Open a browser to this location:
   https://localhost:9999/

2. Log on.

   If you have not yet used the administrative console, the default
   credentials are:

   Administrator (for Username)
   2Federate (for Password)


Limitations
-----------

The demo configuration can be modified to exercise functionality beyond the
example settings provided by default. Because of this, some links 
from the applications will result in errors without additional configuration. 
For example, IdP-discovery, account-linking, and attribute-query 
functionality will not work without administrative-console 
and application configuration changes. Consult the Administrator's Manual
for guidance if you wish to explore these capabilities.

The contents of this directory are provided for demonstration purposes 
only and are not intended for production use.


Additional Information
----------------------

Demo user attributes and integration configuration options are available 
in the WEB-INF/classes directories of their respective exploded application 
WAR directories.

For simplicity, the servlet engine in the PingFederate server is used 
to host the demo applications. This makes demo setup simpler but does not 
represent a supported customer deployment. A more realistic customer 
scenario is to deploy the application in an independent servlet 
container. This is possible with minor configuration changes. Consult
the Administrator's Manual, as needed, for information on how to
make the following modifications: 

- Change the IdP and SP Default URL settings via the Main Menu in the 
  PingFederate administrative console to point to the host and port 
  of the new container.

- Change the URL settings of the IdP and SP Adapter Instances to point 
  to the new host and port.
  
- You may need to update the Trusted CAs in PingFederate depending on the 
  SSL configuration of the container.

This demo configures a single PingFederate instance to perform both the 
IdP and SP roles. In such a deployment, PingFederate is configured as a 
loopback where the server sends messages to and from itself. While this 
is not a realistic scenario, it does keep the example simple. As you
learn more about the configuration of the system, you may wish to
separate the demo federation roles on to distinct PingFederate instances 
as an exercise to further your understanding of the process. 

The reference adapter used in this demo is not a production-ready Ping
Identity adapter. However, for those interested in better understanding 
how this adapter functions, a limited amount of additional information is 
available. See <PF_install>/pingfederate/demo/developer-guide.html.


Copyright
------------------------------
Ping Identity Corporation
1099 18th Street
Suite 2950
Denver, CO 80202
U.S.A.
Phone: 303.468.2900
FAX: 303.468.2909
Email: info@pingidentity.com

Copyright (C) 2007 Ping Identity Corporation. All rights reserved.

Ping Identity and PingFederate are registered trademarks of Ping Identity 
Corporation.

All other trademarks or registered trademarks are the properties of their 
respective owners.

This document is provided for information purposes only, and the information
herein is subject to change without notice. Ping Identity Corporation does 
not provide any warranties and specifically disclaims any liability in 
connection with this document.
