The project article by DarkEdges describes three ways to approach darkedges/pingfederate-graph-broker: start a local simulator-based demo, build a live local identity stack, or deploy the broker and portal to Kubernetes. The crucial distinction is that the listed automated checks are not proof of live integration: DarkEdges says PingFederate, Microsoft Entra, and Microsoft Graph integration has not been run, and the real-tenant acceptance checklist remains unfinished.
Start with the zero-credential demo
For a first look without identity-provider credentials, the article gives a Docker Compose demo using local simulators in place of PingFederate, Entra, and Graph. It reports the demo UI at http://127.0.0.1:8097. This exercises a simulated setup; it does not connect to real identity services.
As an Amazon Associate I earn from qualifying purchases.
- From the project directory, start the demo with
docker compose -f compose.demo.yaml up --build -d. - Open http://127.0.0.1:8097 in a browser.
- When finished, stop the demo with
docker compose -f compose.demo.yaml down.
The article says the demo’s encrypted store is temporary and resets when the stack restarts. Treat its contents as disposable rather than persistent application data.
Run the listed code checks
DarkEdges lists these commands as project checks. They are instructions reported by the article, not results independently reproduced here.
#1 Best Overall
go test -race -count=1 ./...runs the Go test suite with the race detector.go vet ./...runs Go’s static analysis checks.go build -buildvcs=false ./cmd/brokerbuilds the broker command.
The article specifies Go 1.26 or newer. It also says the race detector requires a C compiler and suggests WSL2 or Docker for Windows users who need an environment with that compiler available. Passing these checks would not establish that the application works against a live PingFederate, Entra, or Graph environment.
Choose a live-stack route only when you have the required services
The article describes a local stack that brings real identity-platform configuration into the picture. Its Terraform is split by responsibility rather than being one undifferentiated deployment:
terraform/runtimemanages the Docker Compose runtime.terraform/scopesadopts PingFederate’s global OAuth scopes.- The root
terraformconfiguration covers Entra app registration, access token managers, clients, an identity-provider connection, and the Reference ID adapter.
It names make compose-pf, make compose-broker, and make compose-portal as stack commands. Portal setup requires a locally trusted certificate, while PingFederate setup requires Ping DevOps credentials. These prerequisites distinguish the live-stack route from the zero-credential simulator.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The article also describes Terraform coverage of the PingFederate handoff as incomplete. It does not establish that this route has been validated end to end against a real tenant.
Rank #3
Deploying to Kubernetes means one broker instance
For Kubernetes, the article points to the Helm chart under helm/broker. It packages the broker and portal in one pod, uses a persistent volume, and sets the update strategy to Recreate. Because the store is file-based, the chart rejects replica counts other than one. This is a single-instance deployment design, not a horizontally scaled setup.
Secrets are supplied through an existingSecret. The article lists these chart commands:
make helm-lintmake helm-templatemake helm-upgrade HELM_VALUES=my-values.yaml
For a public hostname, the article mentions a Cloudflare Tunnel guide and explicitly warns against tunneling the PingFederate admin port. A public hostname or successful Helm installation should not be mistaken for proof of production readiness or live identity integration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What has been checked—and what has not
DarkEdges reports that mock-based tests pass, but says live integration with PingFederate, Microsoft Entra, and Graph has not been run. The article’s 11-step real-tenant acceptance checklist in docs/OPERATIONS.md is still incomplete. The distinction matters: unit or mock-based checks can exercise expected behavior without demonstrating that real services, credentials, configuration, and handoffs work together.
DarkEdges writes, “I’d rather say this up front than have you find out in a test environment.” That caution matches the status the article reports: the commands and deployment paths are documented, while real-tenant acceptance remains outstanding.
Current limits and stated next work
The article identifies the following limits in the project’s described state:
- One instance only, with no distributed storage or locking.
- No application-level rate limiting.
- An optional SAML on-behalf-of path that is documented but not provisioned or proven.
- Public Microsoft cloud only and a single tenant.
- Incomplete Terraform coverage of the full PingFederate handoff.
For a future production milestone, DarkEdges lists PostgreSQL transactions with per-connection advisory locks, managed key encryption and rotation, per-object authorization policy, metrics and rate limiting, and integration tests against a non-production PingFederate/Entra environment. These are roadmap items, not capabilities the article demonstrates as complete. It also says an MCP transport may be considered so agent frameworks can use the directory tools; that is a possibility, not a committed feature.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
