Configuring PingFederate properties
The default administrative console and runtime behavior of PingFederate is controlled in part by configuration properties set in the run.properties
file, located in the <pf_install>/pingfederate/bin
directory.
About this task
The most common properties are documented in the following table. For the rest of the properties, including various cookie-encoding options, see the run.properties
file.
The clustering configuration options are also maintained in the |
Property | Description | ||||
---|---|---|---|---|---|
|
Defines the port on which the PingFederate administrative console runs. The default value is |
||||
|
Defines the URL that PingFederate’s administrative node uses to populate resource references in Administrative application programming interface (API) responses. The administrative node also uses it for the redirect URL it sends to an OpenID Provider (OP) for administrator OpenID Connect (OIDC) (for example, https://pingfederate-admin.example.com or, if the load balancer uses a custom port, https://pingfederate-admin.example.com:8443). The default value is blank. Use |
||||
|
Defines the IP address over which the PingFederate administrative console communicates. Use for deployments where multiple network interfaces are installed on the machine running PingFederate. |
||||
|
Defines the browser window or tab title for the administrative console. It makes separate instances easily identifiable. |
||||
|
Defines the name of the PingFederate environment that will be displayed in the administrative console. It makes separate environments easily identifiable. |
||||
|
Enables or disables the background images on the dashboard of the administrative console. The images are enabled by default. |
||||
|
Defines the length of time in minutes until an inactive administrative console times out. The minimum setting is 1 minute, and maximum is 8 hours (480 minutes). Default is |
||||
|
Enables or disables (the default) detailed event logging for actions performed by administrative console users. |
||||
|
Indicates whether more than one administrative user may access the administrative console at one time. Supported values: Single | Multiple. The default value is |
||||
|
Indicates whether administrators sign on to PingFederate using credentials managed internally by PingFederate or externally by other systems. |
||||
|
Defines the authentication method of the PingFederate administrative API. Valid values are:
The default value is You can also configure PingFederate to support both
|
||||
|
These properties set the URL of the PingOne unified admin icon in the PingFederate administrative console. This property should be set based on the region of your PingOne organization. Choose one of the following region-specific values for your environment.
|
||||
|
Defines the ID of your PingOne organization’s environment. |
||||
|
When Lightweight Directory Access Protocol (LDAP) administrative console authentication is enabled, indicates the name of the file containing configuration properties. |
||||
|
When certificate-based console authentication is enabled, indicates the name of the file containing configuration properties. |
||||
|
When RADIUS-based console authentication is enabled, indicates the name of the file containing configuration properties. |
||||
|
When OIDC administrative-console authentication is enabled, indicates the name of the file containing configuration properties. |
||||
|
Defines the port on which PingFederate listens for unencrypted HTTP traffic at runtime. For security reasons, this port is turned off by default.
|
||||
|
Defines the port on which PingFederate listens for encrypted HTTPS (SSL/TLS) traffic. The default value is |
||||
|
Defines a secondary HTTPS port that can be used for mutual SSL/TLS (client X.509 certificate) authentication for both end users and protocol requests (Security Assertion Markup Language (SAML), WS-Trust, and OAuth). Set its value to the desired inbound listening TCP port. A value of
|
||||
|
Defines the IP address over which the PingFederate server communicates with partner federation gateways. Use for deployments where multiple network interfaces are installed on the machine running PingFederate. |
||||
|
Defines the IP address over which Java Management Extensions (JMX) communicate with PingFederate. Use for deployments where multiple network interfaces are installed on the machine running PingFederate. |
||||
|
Defines the protocol to be used by PingFederate. |
||||
|
Specifies the hostname, or the IP address, and the port number of the forward proxy server that HTTP traffic originating from PingFederate must go through. |
||||
|
Specifies the hostname, or the IP address, and the port number of the forward proxy server that HTTPS traffic originating from PingFederate must go through. |
||||
|
Specifies one or more destinations where PingFederate is not required to proxy its HTTP and HTTPS traffic through the forward proxy server configured by the
|
||||
|
Allows customization of the server path for PingFederate endpoints.
The For example, suppose the base URL is https://www.example.com:9031 and the virtual host names are www.example.org and www.example.info. To configure the
|
||||
|
Sets the maximum request size in bytes for inbound runtime requests. The default value is |
||||
|
Network path to the output location of log files. The default is
|
||||
|
Enables or disables (the default) a FIPS-compliance Hardware Security Module (HSM). |
||||
|
Enables or disables the HSM hybrid mode. Applicable only when the When set to The HSM hybrid mode allows an organization to move the storage of keys and certificates from the local trust store to an HSM over time without deploying a new PingFederate installation and mirroring the setup. For more information, see Transitioning to an HSM. |
||||
|
When the If In FIPS-approved mode only, the module will provide approved algorithms only. For more information, see https://www.bouncycastle.org/fips-java/. The default setting is |
||||
|
Enables or disables (the default) outbound provisioning. Also used to enable provisioning failover. |
||||
|
Enables or disables (the default) the heartbeat endpoint, When set to |
||||
|
Determines whether PingFederate omits line breaks in XML digital signatures. If omitted, this setting defaults to |
||||
|
Determines the default connect timeout for outbound java.net.URL connections in milliseconds. The default setting is 10000. |
||||
|
Determines the default read timeout for outbound java.net.URL connections in milliseconds. The default setting is 10000. |
||||
|
The minimum number of threads in HTTP server thread pools for the administrative console. The default value is |
||||
|
The maximum number of threads in HTTP server thread pools for the administrative console. The default value is |
||||
|
The minimum number of threads in HTTP server thread pools for the runtime engine nodes. The default value is |
||||
|
The maximum number of threads in HTTP server thread pools for the runtime engine nodes. The default value is |
||||
|
The queue size of the HTTP connector for the administrative console. The default value is |
||||
|
The queue size of the HTTP connector for the runtime engine nodes. The default value is |
Additional configuration of the listener ports, including adding new listeners, is available through the |