> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# TruU Espresso Adapter

> Detect the TruU desktop authenticator early in a PingFederate policy and route users to a passwordless or password-based flow.

## **1. Overview**

The TruU Espresso adapter for PingFederate tests for the presence of TruU's desktop authenticator on the user's device. Supported authenticators:

> * TruU Windows Authenticator
> * TruU Mac Authenticator
> * TruU Frontline Access

Espresso can be placed early in a PingFederate policy. When a user reaches the adapter, it briefly runs JavaScript in the browser that attempts to connect to the TruU desktop authenticator over a local WebSocket.

| **Result** | **Meaning** | **Policy Behavior** |
| - | - | - |
| Success | TruU was detected locally. | Follows the **Success** branch of the PingFederate policy tree. |
| Failure | TruU was not detected locally. | Follows the **Failure** branch, sending the user down an alternative policy branch. |

Customers can use Espresso to quickly determine whether a user should be sent through a passwordless flow (**Success**) or a password-based flow (**Failure**).

## **2. Installation**

Espresso is installed on PingFederate servers in the same way as other adapters.

**2.1 Download the Adapter**

Download the TruU adapter .zip file from the TruU Admin Console using either method below.

> * **Option A:** Create a PingFederate SSO adapter under Integrations → Adapters.
> * **Option B:** Download the latest PingFederate adapter files from the Downloads page of the Admin Console.

**2.2 Install on PingFederate**

Step 1:  Extract the .zip file. The extracted layout mirrors the layout of the PingFederate installation files. <br />Step 2:  Copy the files into the matching folders on each PingFederate server. <br />Step 3:  Restart the PingFederate service.

## **3. Configuration**

**3.1 Create the IdP Adapter**

Step 1:  Log in to the PingFederate Admin Console. <br />Step 2:  Create a new IdP Adapter. <br />Step 3:  Select **TruU Espresso Adapter** as the adapter type.

**3.2 Enter the Tenant ID**

Enter your TruU tenant ID in the adapter configuration. The tenant ID is found in the TruU Admin Console under My Account.

| **Field** | **Value** |
| - | - |
| Tenant ID | Your TruU tenant ID (Admin Console → My Account) |

The remaining options default to values appropriate for most deployments and are described in the next section.

**3.3 Configuration Options**

| **Option** | **Description** | **Default** |
| - | - | - |
| Enable Handshake | Sends a handshake request over the local WebSocket after the connection is established. The response is analyzed to confirm that Espresso has connected to the TruU desktop authenticator and not to another software component listening on the TruU port. Disabling this option can improve performance, at the risk of false positive detections. | Enabled |
| WebSocket Ports | One or more ports (comma-separated) on which Espresso attempts to communicate with the TruU desktop authenticator. Work with TruU before changing this value. | 5100 |
| Secure WebSocket Ports | Ports used for secure WebSocket connections. Espresso uses a secure WebSocket connection by default for Safari browsers on macOS. | 5200 (TruU Mac Authenticator) |
| Connection Timeout | The time, in milliseconds, that Espresso waits while attempting a WebSocket connection or handshake. | 2000 (2 seconds) |
| Loader Color | The color of the subtle loading indicator displayed while Espresso runs in the browser. Customers may change this to match their branding. | Light gray (#BBBBBB) |

## **4. Policy Configuration**

**4.1 Add Espresso to the Policy Tree**

After creating and configuring the Espresso adapter, add it to your policy tree.

| **⚠** | *Espresso does not collect a user identifier. Do not attempt to use the* `subject` *value when applying the adapter in your policy configuration. Identify the* `subject` *after Espresso, either through the passwordless TruU flow or through a traditional flow (for example, with an HTML Form Adapter).* |
| :- | :- |

**4.2 Example Policy Flow**

The diagram below shows an example policy tree that uses Espresso. Espresso is optional in this flow: it avoids the user ID entry screen for TruU Desktop users.

```mermaid theme={null}
flowchart TD
    A{Espresso}

    A -->|Success| ADAPT[TruU Identity Adapter]
    A -->|Failure| HTML[HTML Form Adapter]
    HTML --> POLICY[Policy Contract]

    ADAPT --> AVAIL{TruU Available?}
    AVAIL -->|Yes| LOAD[Load TruU Identity Server]
    AVAIL -.->|No — fault tolerance fallback| HTML

    LOAD <--> AUTH{Authenticated?}
    AUTH -->|Yes| POLICY
    AUTH -.->|No — fallback| HTML
```

> * **Espresso Success:** The user goes directly to the TruU Identity Adapter, with no user ID entry screen.
> * **Espresso Failure:** The user goes to the HTML Form Adapter, then to the Policy Contract.
> * **TruU Available:** The TruU Identity Adapter checks whether TruU is available. If it is, PingFederate loads the TruU Identity Server. If it is not, the policy falls back to the HTML Form Adapter (fault tolerance).
> * **Authenticated:** A successful authentication continues to the Policy Contract. A failed authentication falls back to the HTML Form Adapter.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.