Download the sample application, IG-sample-application-6.5.4.jar, from the ForgeRock BackStage download site .

Run the sample application:

$ java -jar IG-sample-application-6.5.4.jar
Preparing to listen for HTTP on port 8081.
Preparing to listen for HTTPS on port 8444.
The server will use a self-signed certificate not known to browsers.
When using HTTPS with curl for example, try --insecure.
Using OpenAM URL: http://openam.example.com:8088/openam/oauth2.
Starting server...
Sep 09, 2016 9:52:56 AM org.glassfish.grizzly.http.server.NetworkListener start
INFO: Started listener bound to [0.0.0.0:8444]
Sep 09, 2016 9:52:56 AM org.glassfish.grizzly.http.server.NetworkListener start
INFO: Started listener bound to [0.0.0.0:8081]
Sep 09, 2016 9:52:56 AM org.glassfish.grizzly.http.server.HttpServer start
INFO: [HttpServer] Started.
Press Ctrl+C to stop the server.

By default, this server listens for HTTP on port 8081, and for HTTPS on port 8444. If one or both of those ports are not free, specify other ports:

$ java -jar IG-sample-application-6.5.4.jar 8888 8889
Preparing to listen for HTTP on port 8888.
Preparing to listen for HTTPS on port 8889.
The server will use a self-signed certificate not known to browsers.
When using HTTPS with curl for example, try --insecure.
Using OpenAM URL: http://openam.example.com:8088/openam/oauth2.
Starting server...
Sep 09, 2016 9:55:57 AM org.glassfish.grizzly.http.server.NetworkListener start
INFO: Started listener bound to [0.0.0.0:8889]
Sep 09, 2016 9:55:57 AM org.glassfish.grizzly.http.server.NetworkListener start
INFO: Started listener bound to [0.0.0.0:8888]
Sep 09, 2016 9:55:57 AM org.glassfish.grizzly.http.server.HttpServer start
INFO: [HttpServer] Started.
Press Ctrl+C to stop the server.

If you change the port numbers when starting the server, also account for the differences when using the examples.

Browse to http://localhost:8081/home to access the home page of the sample application.

Some information about the browser request is displayed.

Browse to http://localhost:8081/login to access the login page of the sample application, and then log in with username demo and password Ch4ng31t.

The username and some information about the browser request is displayed.

Stop Jetty:

Start Jetty:

Browse to http://openig.example.com:8080/openig/studio, and select  Protect an Application.

Choose  Structured, and enter a URL for the application you want to protect, followed by a path condition to access the route. For example, enter http://app.example.com:8081/my-basic-route.

On the top-right of the screen, select  and  Display to review the route.

A route similar to this is displayed, where the path condition is used for the route name:

{
  "name": "my-basic-route",
  "baseURI": "http://app.example.com:8081",
  "condition": "${matches(request.uri.path, '^/my-basic-route')}",
  "handler": "ReverseProxyHandler"
}

In Studio, select  ROUTES and then select a route.

On the top-right of the screen select  Route settings.

Using the on-screen hints for guidance, change the name, condition, or other features of the route, and save the changes.

On the top-right of the screen, select  and  Display to review the route.

In Studio, select  ROUTES and then select a route.

On the top-right of the screen, select  and  Display to review the route.

If the route is okay, select  Deploy to push the route to the IG configuration.

The route status  Deployed is displayed, and the  Deploy button is grey and disabled.

Check the $HOME/.openig/config/routes folder in your IG configuration to see that the route is there.

By default, routes are loaded automatically into the IG configuration. You don't need to stop and restart IG. For information about reloading routes, see "Preventing the Reload of Routes" in the Gateway Guide.

Check the system log messages to confirm that the route was loaded succesfully into the configuration. For information about logs, see "Logging Events" in the Gateway Guide.

In Studio, select  ROUTES and then select a route.

On the top-right of the screen, select  and  Undeploy, and then confirm your request.

The route is removed from the IG configuration. On the Studio screen, the route status  Deployed is no longer displayed, and the  Deploy option is active again.

In Studio, select  ROUTES and then select a route.

Select  Other filters,  New filter, and then Other filter.

In Type, select a filter type from the list, and then optionally enter a name and configuration for the filter.

When you save, the filter is added to the chain. Select  Chain on the left of the screen to view the chain.

Deploy the route as described in "Deploying Routes to Your Configuration".

In Studio, select  ROUTES and then select a route.

Edit the route in Studio or manually:

The route status is  Changes pending.

Deploy the route as described in "To Deploy a Route to Your Configuration".

In Studio, select  ROUTES and then  Import a route.

Click in the window to import a route, or drag a route from your filesystem.

If the route has a name property, the name is automatically used for the Name and ID fields in Studio.

If necessary, make the following changes, and then select Import:

The route is added to the list of routes on the  ROUTES page.

Deploy the route as described in "Deploying Routes to Your Configuration".

Select Applications > Agents > Identity Gateway, add an agent with the following values:

Leave all other values as default.

Set an environment variable for the IG agent password, and then restart IG:

$ export AGENT_SECRET_ID='cGFzc3dvcmQ='

The password is retrieved by a SystemAndEnvSecretStore, and must be base64-encoded.

Add the following file to the IG configuration as $HOME/.openig/config/admin.json (on Windows, %appdata%\OpenIG\config\admin.json):

{
  "prefix": "openig",
  "mode": "DEVELOPMENT",
  "properties": {
    "SsoTokenCookieOrHeader": "iPlanetDirectoryPro"
  },
  "heap": [
    {
      "name": "SystemAndEnvSecretStore-1",
      "type": "SystemAndEnvSecretStore"
    },
    {
      "name": "AmService-1",
      "type": "AmService",
      "config": {
        "agent" : {
          "username" : "ig_agent",
          "passwordSecretId" : "agent.secret.id"
        },
        "secretsProvider": "SystemAndEnvSecretStore-1",
        "url": "http://openam.example.com:8088/openam/",
        "ssoTokenHeader": "&{SsoTokenCookieOrHeader}",
        "version": "${platform.version}"
      }
    },
    {
      "name": "StudioProtectionFilter",
      "type": "ChainOfFilters",
      "config": {
        "filters": [
          {
            "type": "SingleSignOnFilter",
            "config": {
              "amService": "AmService-1"
            }
          },
          {
            "type": "CsrfFilter",
            "config": {
              "cookieName": "&{SsoTokenCookieOrHeader}",
              "failureHandler": {
                "type": "StaticResponseHandler",
                "config": {
                  "status": 403,
                  "headers": {
                    "Content-Type": [
                      "text/plain"
                    ]
                  },
                  "entity": "Request forbidden"
                }
              }
            }
          }
        ]
      }
    }
  ]
}

Notice the following features of the file:

Restart IG to take into account the changes to admin.json.

Access Studio on http://openig.example.com:8080/openig/studio. The SingleSignOnFilter redirects the request to AM for authentication.

Log in to AM with username demo, password changeit. The Studio  ROUTES screen is displayed.