The admin.auth configuration setting, specifically admin.auth.type within the run.properties file, is designed as a failsafe mechanism for the PingAccess administrative console. When Single Sign-On (SSO) is configured as the primary authentication method for administrators, this setting allows for an alternative method, such as basic authentication, to be enabled. Its purpose is to override the SSO flow, ensuring that an administrator can still log in if the primary identity provider (e.g., PingFederate) is unavailable, thereby preventing administrative lockout.

A. SSO for the administrative UI is configured within the PingAccess console itself, not directly through this failsafe setting in the run.properties file.

B. Administrative API authentication is configured separately, typically using OAuth 2.0 client credentials or a dedicated basic authentication account, and is distinct from this UI-specific setting.

D. This setting configures an explicit, alternative authentication challenge (like a username/password prompt); it does not enable any form of automatic or passwordless sign-on.

---

1. Ping Identity PingAccess 7.3 Documentation, Administrator Guide, "Configuring administrative authentication," Section: "Failsafe administrative sign on."

This section explicitly states, "To prevent being locked out of the PingAccess administrative console if PingFederate is unavailable, you can configure a failsafe authentication method... This is done by setting the admin.auth.type property in the run.properties file to basic." This directly supports the concept of an override or failsafe.

2. Ping Identity PingAccess 7.3 Documentation, Administrator Guide, "Getting Started," Section: "The run.properties file."

This section details the properties within the run.properties file. For admin.auth.type, it describes the available values (sso or basic) and clarifies that basic can be used as a fallback when SSO is the primary method, reinforcing its role as an override mechanism.