---
title: Configuring service authentication
description: Administrators with the Admin role can activate and configure authentication for Attribute Query, Java Management Extensions (JMX), and SSO Directory Service.
component: pingfederate
version: 13.1
page_id: pingfederate:administrators_reference_guide:help_manageserviceauthenticationtasklet_serviceauthenticationstate
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/help_manageserviceauthenticationtasklet_serviceauthenticationstate.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: July 5, 2022
section_ids:
  about-this-task: About this task
  steps: Steps
---

# Configuring service authentication

Administrators with the **Admin** role can activate and configure authentication for Attribute Query, Java Management Extensions (JMX), and SSO Directory Service.

## About this task

If you are using the SAML 2.0 Attribute Query profile as a service provider (SP), then the requesting applications at your site must authenticate to the PingFederate server. For more information, see [Attribute Query and XASP](../introduction_to_pingfederate/pf_attrib_query_xasp.html) and the [developers\_reference\_guide:pf\_sp\_services.adoc#spStartAttributeQueryPing](../developers_reference_guide/pf_sp_services.html#spStartAttributeQueryPing) SP application endpoint.

Authentication is required to access PingFederate runtime data via JMX (see [Runtime monitoring using JMX](../pingfederate_monitoring_guide/pf_runtime_monitor_using_jmx.html)) or to make SOAP calls to the Connection Management Service. Authentication is optional for the SSO Directory Service. For more information, see [Web service interfaces and APIs](../developers_reference_guide/pf_web_service_interface_api.html) and [SSO Directory Service](../developers_reference_guide/pf_sso_directory_service.html).

|   |                                                                                                                       |
| - | --------------------------------------------------------------------------------------------------------------------- |
|   | To help ensure network security, access to all of these services is deactivated when PingFederate is first installed. |

To activate and configure authentication for the Connection Management Service, grant the administrators all three administrative roles: **Admin**, **Crypto**, and **User Admin**. For more information, see [Connection Management Service](../developers_reference_guide/pf_connection_management_service.html).

## Steps

* To enable a service:

  1. On **Security > System Integration > \[.wintitle]** **Service Authentication**\***, select \*Action > Activate** for your desired service.

  2. Enter or modify) the service account **ID** and define or reset the **Shared Secret**.

     You and the application developer must agree to these values.

  |   |                                                           |
  | - | --------------------------------------------------------- |
  |   | Authentication is optional for the SSO Directory Service. |

* To disable a service, on \*Security > **Service Authentication**, select **Deactivate** under **Action** for your desired service.

  |   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
  | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  |   | Although not accessible when deactivated, the Connection Management Service and the SSO Directory Service are deployed by default with PingFederate. If your organization does not plan to use one or both of these services, you can remove the following WAR file or files:- `<pf_install>/pingfederate/server/deploy2/pf-mgmt-ws.war` for the Connection Management Service

  - `<pf_install>/pingfederate/server/deploy/pf-ws.war` for the SSO Directory Service |