The ForceAuth=true query parameter instructs PingAM to challenge the user for credentials, regardless of whether they have an existing valid session. This ensures that the user re-authenticates for the current transaction. This mechanism is commonly used to step-up security for accessing sensitive resources or performing critical actions, guaranteeing the user's presence at that specific moment. It effectively ignores the single sign-on (SSO) state for that one request.

B. This parameter forces a full re-authentication from the beginning of the configured chain or tree, not necessarily just a second factor.

C. ForceAuth is a recognized and processed parameter within PingAM for controlling authentication behavior.

D. This describes a multi-factor authentication enrollment prompt, which is a different function from forcing re-authentication.

1. Ping Identity, PingAM 7.3 Documentation, "Authentication," Section: "Authentication request parameters." (This section details parameters like ForceAuth that can be appended to the authentication URL to modify the authentication process).

2. ForgeRock, Access Management 6.5 Documentation, "Authentication," Section: "Authentication Endpoint Parameters." (PingAM is based on ForgeRock AM, and this documentation explicitly states: "If the value of this parameter is true, the user must reauthenticate, even if they have a valid session.").