--- title: Alternative console authentication description: As an alternative to using PingFederate's own internal datastore for authentication to the administrative console, you can configure PingFederate to use your network's Lightweight Directory Access Protocol (LDAP) user-datastore, the Remote Authentication Dial-In User Service (RADIUS) protocol, client certificates, or OpenID Connect (OIDC)-based authentication. component: pingfederate version: 12.3 page_id: pingfederate:administrators_reference_guide:pf_alternative_console_authentication canonical_url: https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/pf_alternative_console_authentication.html llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: September 3, 2026 superseded_by: https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/pf_alternative_console_authentication.html --- # Alternative console authentication As an alternative to using PingFederate's own internal datastore for authentication to the administrative console, you can configure PingFederate to use your network's Lightweight Directory Access Protocol (LDAP) *(tooltip: \
\

An open, cross platform protocol used for interacting with directory services.\

\
)* user-datastore, the Remote Authentication Dial-In User Service (RADIUS) *(tooltip: \
\

A client/server networking protocol providing centralized user management.\

\
)* protocol, client certificates, or OpenID Connect (OIDC) *(tooltip: \
\

An authentication protocol built on top of OAuth that authenticates users and enables clients (relying parties) of all types to request and receive information about authenticated sessions and users. OIDC is extensible, allowing clients to use optional features such as encryption of identity data, discovery of OpenID Providers (OAuth authorization servers), and session management.\

\
)*-based authentication. You can configure any of these alternative console authentication methods at any time. Most user-management functions are handled outside the scope of the PingFederate admin console when alternative authentication is enabled. Unlike native authentication, for which you configure local accounts and their privileges in **System > Server > Administrative Accounts**, you must define roles in configuration files when using an alternative authentication scheme. Similar to native authentication, PingFederate provides two account types and five administrative roles for role-based access control (RBAC), as shown in the following table: | Account type | Administrative role | Access privileges | | ------------ | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin | User Admin | Create users, deactivate users, change or reset passwords, and install replacement license keys. | | Admin | Admin | Configure partner connections and most system settings, except the management of local accounts and the handling of local keys and certificates. | | Admin | Expression Admin | Map user attributes by using the OGNL expression language. Only administrative users who have both the Admin role and the Expression Admin role: Can be granted the User Admin role. This restriction prevents non-Expression Admin users from granting themselves the Expression Admin role. Can be granted write access to the file system or directory where PingFederate is installed. This restriction prevents a non-Expression Admin user from placing a data.zip file containing expressions into the \/pingfederate/server/default/deploy directory, which would introduce expressions into PingFederate. | | Admin | Crypto Admin | Manage local keys and certificates. | | Admin | Data Collection Admin | Collect support data using the [Collect Support Data](pf_collecting_support_data_admin_console.html) menu.Administrators must have Admin, User Admin, and Crypto Admin roles to be given this role. | | Auditor | Not applicable | View-only permissions for all administrative functions. When the **Auditor** role is assigned, no other administrative roles can be set. | | | | | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | All five administrative roles are required to access and make changes through the following services:- The `/bulk`, `/configArchive`, and `/configStore` administrative API endpoints - The **Configuration Archive** page, accessed from **System > Server**, in the administrative console - The **Connection Management** configuration item on the **Service Authentication** page, accessed from **Security > System Integration** |