The engine.ssl.protocols property within the run.properties file is used to explicitly define the SSL/TLS protocol versions that the PingFederate runtime engine's listeners will support. Administrators use this property to enhance security by disabling older, vulnerable protocols (e.g., SSLv3, TLSv1.0, TLSv1.1) and enforcing the use of modern, secure versions like TLSv1.2 and TLSv1.3. The value is a comma-separated list of the desired protocol versions. This configuration applies to the main HTTPS listeners of the PingFederate server.

A. Supported ciphers are configured using a different property, typically pf.engine.ssl.ciphers.

B. The HTTPS port is configured using the pf.https.port property.

D. This property affects all engine listeners, not just clustering; specific clustering communication settings are managed elsewhere.

---

1. Ping Identity PingFederate Documentation, Server Administration > System Services > Configuring protocols and cipher suites. This section explicitly states: "To specify the protocols for the PingFederate runtime-engine listeners, edit the pf.engine.ssl.protocols property in the /pingfederate/bin/run.properties file."

2. Ping Identity PingFederate Documentation, Installation > Pre-installation planning > System requirements > Java virtual machine options. The documentation notes that the JVM's enabled protocols can be a limiting factor, but PingFederate's specific protocol configuration is managed in run.properties via pf.engine.ssl.protocols.

3. Ping Identity Knowledge Base, Article 000030400, How to change the default TLS protocol version of PingFederate. This official support article guides administrators to "Modify the pf.engine.ssl.protocols parameter in the /pingfederate/bin/run.properties file" to control the enabled TLS versions.

The admin.auth configuration setting, specifically admin.auth.type within the run.properties file, is designed as a failsafe mechanism for the PingAccess administrative console. When Single Sign-On (SSO) is configured as the primary authentication method for administrators, this setting allows for an alternative method, such as basic authentication, to be enabled. Its purpose is to override the SSO flow, ensuring that an administrator can still log in if the primary identity provider (e.g., PingFederate) is unavailable, thereby preventing administrative lockout.

A. SSO for the administrative UI is configured within the PingAccess console itself, not directly through this failsafe setting in the run.properties file.

B. Administrative API authentication is configured separately, typically using OAuth 2.0 client credentials or a dedicated basic authentication account, and is distinct from this UI-specific setting.

D. This setting configures an explicit, alternative authentication challenge (like a username/password prompt); it does not enable any form of automatic or passwordless sign-on.

---

1. Ping Identity PingAccess 7.3 Documentation, Administrator Guide, "Configuring administrative authentication," Section: "Failsafe administrative sign on."

This section explicitly states, "To prevent being locked out of the PingAccess administrative console if PingFederate is unavailable, you can configure a failsafe authentication method... This is done by setting the admin.auth.type property in the run.properties file to basic." This directly supports the concept of an override or failsafe.

2. Ping Identity PingAccess 7.3 Documentation, Administrator Guide, "Getting Started," Section: "The run.properties file."

This section details the properties within the run.properties file. For admin.auth.type, it describes the available values (sso or basic) and clarifies that basic can be used as a fallback when SSO is the primary method, reinforcing its role as an override mechanism.

RFC-5280 (Section 6) specifies the algorithm for validating a certification path, which typically assumes a coherent, ordered chain from the end-entity certificate to a trusted root. When a legacy PKI solution does not adhere to this standard, it may present the certificates in the chain out of order. The "Validate disordered certificate chains" option in PingAccess is specifically designed to address this issue. When enabled, PingAccess will attempt to reorder the provided certificates to build a valid path to a trusted certificate authority, thereby accommodating the non-compliant behavior of the legacy system.

A. Use Java Trust Store: This option supplements the configured trust group with CAs from the JVM's default trust store; it does not alter the logic for validating the order of a certificate chain.

C. Skip Certificate Date Check: This option bypasses the notBefore and notAfter validity checks on a certificate, which is unrelated to the structural validation of the certificate path itself.

D. Deny when unable to determine revocation status: This setting controls behavior related to certificate revocation checking (CRL/OCSP), which is a separate process from the initial path construction and validation.

1. Ping Identity PingAccess 7.3 Documentation:

Source: PingAccess Administrator Guide > Configuring PingAccess > Configuring Trusted Certificate Groups.

Reference: In the "Trusted Certificate Group Fields" table, the description for Validate disordered certificate chains states: "Select this check box to allow PingAccess to validate certificate chains that are not in the correct order. This option is useful when working with older systems that do not order certificate chains correctly." This directly addresses the scenario of a legacy system not adhering to standard chain presentation.

To prevent PingAccess from starting automatically on a Windows Server, the associated Windows Service must be removed. PingAccess provides a specific batch script for this purpose. The uninstall-service.bat command, located in the /bin directory, unregisters the PingAccess service from the Windows Service Control Manager. Once the service is removed, it can no longer be started automatically by the operating system during boot-up.

A. init.bat: This is not a standard script provided with PingAccess for managing the Windows service. Its function is not related to service installation or removal.

C. remove-install.bat: This is not a valid or documented PingAccess command. There is no such script included in the standard PingAccess distribution for service management.

D. wrapper-service.bat: While this script interacts with the Java Service Wrapper, it is not the primary command intended for administrators. The uninstall-service.bat script is the designated high-level utility that calls the wrapper with the correct parameters for service removal.

1. Ping Identity PingAccess 7.3 Documentation, "Start and stop PingAccess," section "Running PingAccess as a service on Windows."

This official guide explicitly states: "To remove the PingAccess service, run /bin/uninstall-service.bat." This confirms that uninstall-service.bat is the correct command to unregister the service, thereby preventing it from starting automatically.

In PingAccess, the SameSite attribute for the session cookie (PA.user) is a global setting that dictates browser behavior for cross-site requests. This critical security setting is configured centrally within the Web Sessions section of the administrative console. This allows administrators to enforce a consistent session cookie policy (e.g., Lax, Strict, or None) across all applications and user sessions managed by that PingAccess instance, enhancing protection against cross-site request forgery (CSRF) attacks.

A. Rules: Rules are used to define the logic for granting or denying access to resources, not for configuring session cookie attributes.

B. Sites: Sites define the backend web servers that PingAccess protects; they do not control the properties of the PingAccess session cookie.

C. Applications: Applications define the specific resources being protected, but the fundamental behavior of the session cookie is managed globally under Web Sessions.

1. Ping Identity PingAccess 7.3 Administrator's Guide, Section: "Configuring Web Sessions". The configuration table in this section explicitly lists the "SameSite Cookie" setting and its available options (Disabled, Lax, Strict, None), confirming its location within the Web Sessions menu. (Accessed via Ping Identity Documentation portal).