Introduction to self-service promotions

PingOne Advanced Identity Cloud lets you run self-service promotions to move static configuration between a sequential pair of tenant environments, either from the development environment to the staging environment (staging promotion), or from the staging environment to the production environment (production promotion).

Non-sequential promotions (between the development environment and the production environment) are not supported.

If you promote configuration that accidentally causes instability or errors, Advanced Identity Cloud lets you run a self-service rollback to restore an upper environment to its previous configuration.

You can run a promotion or a rollback using the following options:

Manage self-service promotions using the API (promotion and rollback)
Manage self-service promotions using the UI (promotion only)

The Advanced Identity Cloud configuration model

The following video summarizes the concepts of the Advanced Identity Cloud configuration model:

Static and dynamic configuration

Learn about the difference between static and dynamic configuration in these FAQs:

Lower and upper environments

In a sequential pair of environments, we refer to the lower environment (the configuration source), and the upper environment (the configuration destination). The terms lower environment and upper environment therefore refer to different environments, depending on which environment you are promoting to.

Standard promotion group of environments

For a standard promotion group of development, staging, and production tenant environments, the lower and upper environments are:

	Development environment	Staging environment	Production environment
Staging promotion	south lower	north upper
Production promotion		south lower	north upper

Development
environment

Staging
environment

Production
environment

Staging promotion

south lower

north upper

Production promotion

south lower

north upper

Key:

south lower = lower environment (configuration source)
north upper = upper environment (configuration destination)

Additional UAT environments

If you add any UAT environments to your promotion group of environments, they are inserted into the promotion process before the staging environment:

If you add one UAT environment, the revised lower and upper environments are:

	Development environment	UAT environment	Staging environment	Production environment
UAT promotion	south lower	north upper
Staging promotion		south lower	north upper
Production promotion			south lower	north upper

Development
environment

UAT
environment

Staging
environment

Production
environment

UAT promotion

south lower

north upper

Staging promotion

south lower

north upper

Production promotion

south lower

north upper

If you add a second UAT environment, the revised lower and upper environments are:

	Development environment	UAT environment	UAT2 environment	Staging environment	Production environment
UAT promotion	south lower	north upper
UAT2 promotion		south lower	north upper
Staging promotion			south lower	north upper
Production promotion				south lower	north upper

Development
environment

UAT
environment

UAT2
environment

Staging
environment

Production
environment

UAT promotion

south lower

north upper

UAT2 promotion

south lower

north upper

Staging promotion

south lower

north upper

Production promotion

south lower

north upper

The lower and upper environments are revised in the same way for each additional UAT environment you add.

Environment locking

Locking an environment prevents configuration changes that could disrupt a promotion or a rollback; however, all authentication flows continue to work as normal.

Before you run a promotion or a rollback, you must lock the lower and upper environments. This prevents anyone else from locking either of those environments, which ensures only one promotion or rollback can be run at the same time in the same set of development, staging, and production environments.

Locking the lower and upper environments also blocks access to the ESV API in those environments. This prevents anyone else from accidentally disrupting a promotion or rollback by manipulating ESV configuration values. If the lower environment is also the development environment, then most Advanced Identity Cloud API endpoints are also restricted.

When a promotion or a rollback is complete, you must unlock the lower and upper environments to return the environments back to full functionality.

Configuration integrity checks

When you run a promotion or a rollback, Advanced Identity Cloud performs integrity checks on your static configuration to protect the stability of the upper environment.

Integrity check for missing ESVs

	Promotion	Rollback
Checked?	Yes	Yes

Promotion

Rollback

Checked?

Yes

This integrity check looks for ESVs referenced in your static configuration, but not set in the upper environment.

Advanced Identity Cloud runs this integrity check on the whole configuration, not just configuration changes.

Integrity check for encrypted secrets

	Promotion	Rollback
Checked?	Yes	No

Promotion

Rollback

Checked?

Yes

This integrity check looks for encrypted secrets embedded directly in your static configuration. It is best practice to store encrypted secrets in an ESV secret and update your configuration to reference the ESV secret instead.

Advanced Identity Cloud runs this integrity check on the whole configuration, not just configuration changes.