Using the System Plan
Warning: Single Sign‑On for Pivotal Cloud Foundry v1.8 is no longer supported because it has reached the End of General Support (EOGS) phase as defined by the Support Lifecycle Policy. To stay up to date with the latest software and security updates, upgrade to a supported version.
This topic explains how to use the system plan for the Single Sign-On (SSO) service for Pivotal Cloud Foundry (PCF). The system plan is the default plan meant for developer apps, not end-user apps.
SSO for PCF comes with a default
system plan that has the following features:
- Minimal configuration options
- Not deletable
- Allows developer-level access to system components like Pivotal Application Service (PAS) and its APIs
- Available only to PCF administrators
Restricting the visibility of this system plan to a single, developer-apps only org secures system components, following the principle of least privilege.
Examples of developer apps include scripts or pipelines that push other apps and services. Any app that uses the Cloud Foundry API is a developer app.
Pivotal recommends configuring your orgs and SSO plans as follows to prevent anyone from applying the system plan to end-user apps:
Restrict all developer apps to a single org.
Make the system plan visible only to the developer-apps org.
Configure other orgs with SSO service plans of their own.
Developers can then self-register their developers apps in the developer-apps org for use by other developers.
PCF administrators follow the steps below to enable the system plan and provide access to app developers:
Log into the SSO dashboard at
https://p-identity.YOUR-SYSTEM-DOMAINusing your User Account and Authentication (UAA) administrator credentials. In your PAS tile in Ops Manager, the Domain settings show your system domain, and the Credentials tab shows the UAA Admin Credentials.
Navigate to the System Plan and enable the plan in the relevant org(s).
Follow the steps below to create and use the
system service plan with your developer apps.
Follow the steps to Create a Service Instance of SSO.
If you have a PCF app, bind the application with the service instance you created. For more information, see Bind a PCF App.
If your app is a pipeline or a script that runs external to PCF but calls PCF APIs, do the following:
- Follow the instructions to Register an Externally Hosted App Using the SSO Dashboard
and use the guidelines below:
- Choose Native App for your application type.
- In the app configuration, set a value for the Refresh token lifetime based on your use case for automated access.
- To give your your pipeline or script access to your resources without your
presence, embed a refresh token instead of hardcoding your credentials:
uaac token sso get.
- At the prompts, enter the Client ID and Secret from the Next Steps section of the SSO dashboard. Copy the authentication URL from the command output.
- Paste the authentication URL into a browser, and log in using your UAA Admin Credentials.
- Copy the Temporary Authentication Code from the browser into the UAAC to finish the authentication.
- Copy the value of the refresh token and use that in your code to get a new token based on your client ID and secret using the standard OAuth refresh token flow as described in the UAA API documentation.
- Follow the instructions to Register an Externally Hosted App Using the SSO Dashboard and use the guidelines below:
To revoke system plan access from an externally hosted app that is registered with the system plan to access PCF components, do one of the following:
- Regenerate the App Secret
- Delete the app