TruU Espresso Adapter

1. Overview

The TruU Espresso adapter for PingFederate tests for the presence of TruU’s desktop authenticator on the user’s device. Supported authenticators:

TruU Windows Authenticator

TruU Mac Authenticator

TruU Frontline Access

Espresso can be placed early in a PingFederate policy. When a user reaches the adapter, it briefly runs JavaScript in the browser that attempts to connect to the TruU desktop authenticator over a local WebSocket.

Result	Meaning	Policy Behavior
Success	TruU was detected locally.	Follows the Success branch of the PingFederate policy tree.
Failure	TruU was not detected locally.	Follows the Failure branch, sending the user down an alternative policy branch.

Customers can use Espresso to quickly determine whether a user should be sent through a passwordless flow (Success) or a password-based flow (Failure).

2. Installation

Espresso is installed on PingFederate servers in the same way as other adapters. 2.1 Download the Adapter Download the TruU adapter .zip file from the TruU Admin Console using either method below.

Option A: Create a PingFederate SSO adapter under Integrations → Adapters.

Option B: Download the latest PingFederate adapter files from the Downloads page of the Admin Console.

2.2 Install on PingFederate Step 1: Extract the .zip file. The extracted layout mirrors the layout of the PingFederate installation files.
Step 2: Copy the files into the matching folders on each PingFederate server.
Step 3: Restart the PingFederate service.

3. Configuration

3.1 Create the IdP Adapter Step 1: Log in to the PingFederate Admin Console.
Step 2: Create a new IdP Adapter.
Step 3: Select TruU Espresso Adapter as the adapter type. 3.2 Enter the Tenant ID Enter your TruU tenant ID in the adapter configuration. The tenant ID is found in the TruU Admin Console under My Account.

Field	Value
Tenant ID	Your TruU tenant ID (Admin Console → My Account)

The remaining options default to values appropriate for most deployments and are described in the next section. 3.3 Configuration Options

Option	Description	Default
Enable Handshake	Sends a handshake request over the local WebSocket after the connection is established. The response is analyzed to confirm that Espresso has connected to the TruU desktop authenticator and not to another software component listening on the TruU port. Disabling this option can improve performance, at the risk of false positive detections.	Enabled
WebSocket Ports	One or more ports (comma-separated) on which Espresso attempts to communicate with the TruU desktop authenticator. Work with TruU before changing this value.	5100
Secure WebSocket Ports	Ports used for secure WebSocket connections. Espresso uses a secure WebSocket connection by default for Safari browsers on macOS.	5200 (TruU Mac Authenticator)
Connection Timeout	The time, in milliseconds, that Espresso waits while attempting a WebSocket connection or handshake.	2000 (2 seconds)
Loader Color	The color of the subtle loading indicator displayed while Espresso runs in the browser. Customers may change this to match their branding.	Light gray (#BBBBBB)

4. Policy Configuration

4.1 Add Espresso to the Policy Tree After creating and configuring the Espresso adapter, add it to your policy tree.

⚠	Espresso does not collect a user identifier. Do not attempt to use the `subject` value when applying the adapter in your policy configuration. Identify the `subject` after Espresso, either through the passwordless TruU flow or through a traditional flow (for example, with an HTML Form Adapter).

4.2 Example Policy Flow The diagram below shows an example policy tree that uses Espresso. Espresso is optional in this flow: it avoids the user ID entry screen for TruU Desktop users.

Espresso Success: The user goes directly to the TruU Identity Adapter, with no user ID entry screen.

Espresso Failure: The user goes to the HTML Form Adapter, then to the Policy Contract.

TruU Available: The TruU Identity Adapter checks whether TruU is available. If it is, PingFederate loads the TruU Identity Server. If it is not, the policy falls back to the HTML Form Adapter (fault tolerance).

Authenticated: A successful authentication continues to the Policy Contract. A failed authentication falls back to the HTML Form Adapter.

Overview

TruU Tenant Setup

Infrastructure Configuration

TruU Adapters & Integrations

Deploy TruU on Windows

Deploy TruU on macOS

Deploy Frontline Access

Deploy Continuous Authentication

Admin Console Overview

TruU Espresso Adapter

1. Overview

2. Installation

3. Configuration

4. Policy Configuration

​1. Overview

​2. Installation

​3. Configuration

​4. Policy Configuration

1. Overview

2. Installation

3. Configuration

4. Policy Configuration