Ping Identity’s PingFederate

Identity federation enables Single Sign-On (SSO) across different domains, allowing users from one organization to access applications in another without maintaining separate accounts or passwords. It underpins mission-critical connections across sectors such as education, finance, healthcare, retail, government, media, and complex supply chains. Beyond user convenience, federation reduces password sprawl and the overall identity attack surface, while improving security operations because a user’s “home” organization typically handles account termination and updates more quickly and reliably than downstream service providers. This shifts account maintenance responsibility to Identity Providers (IdPs) and reduces duplicate account administration for Relying Parties (RPs).

Federation also extends and bridges traditional web access management (WAM), including across different vendors’ systems, helping organizations avoid vendor lock-in and simplifying integration and separation during mergers, acquisitions, and divestitures. Common federation technologies include SAML, OAuth, OpenID Connect, JSON Web Tokens (JWT), WS-Federation, and WS-Trust.

Ping Identity’s PingFederate is positioned as a flagship, standards-focused federation server supporting major protocols and deployment models (on-premises, cloud, hybrid) across multiple operating systems. It can function in multiple roles, including IdP, Service Provider, OAuth Authorization Server, OpenID Connect Provider, identity bridge, federation hub, and Secure Token Service (STS). It integrates with enterprise directories and authentication methods, supports extensive application and WAM integrations, and offers advanced capabilities such as single logout, account linking/mapping, attribute queries, SCIM and just-in-time provisioning, and token transformation with policy-driven attribute enrichment. Operationally, it exposes logs and APIs for SIEM integration and supports adaptive authentication architectures through configurable rules and context evaluation. The product is described as scalable, widely deployed, and administratively straightforward, with noted gaps around built-in reporting and behavioral analytics.

• Identity federation enables Single Sign-On (SSO) between different domains.
• Federation reduces the number of passwords users must remember, shrinking the identity attack surface.
• Relying Parties depend on Identity Providers to maintain, update, and remove accounts.
• Federation can bridge WAM systems, including systems from different vendors.
• PingFederate supports SAML, OpenID, OpenID Connect, OAuth, WS-Federation, WS-Security, and WS-Trust.
• PingFederate can be deployed on-premises, in the cloud, or in a hybrid configuration.
• PingFederate can operate as an IdP, SP, OAuth Authorization Server, OpenID Connect Provider, identity bridge, federation hub, and Secure Token Service.
• PingFederate integrates with Microsoft Active Directory, Azure AD, LDAP, RADIUS, and X.509.
• PingFederate supports authentication via Integrated Windows Authentication (Kerberos/NTLM), LDAP, JDBC databases, and RADIUS.
• Ping Identity has more than 1,500 customers serving millions of users.

• “Identity federation is the foundational element for enabling Single Sign-On (SSO) between different domains.”
• “The classic federation use case is a set of users in one domain (Acme.com) leveraging their identity credentials and authentication events to gain access to another domain (Globex.com), without having to explicitly maintain distinct accounts and login with different passwords.”
• “Identity federation is one of the main technologies that helps organizations move away from password-based authentication.”
• “Federation also simplifies account maintenance across connected sites.”
• “Federation technology can bridge WAM systems, even between WAM systems by different vendors.”
• “PingFederate is the standards-bearer of federation standards products.”
• “PingFederate features multi-protocol identity federation standards support.”
• “PingFederate can serve as a federation hub and/or a Secure Token Service.”
• “Many organizations have deployed PingFederate as a component of an Adaptive Authentication (AA) architecture.”
• “Whether installed locally or in the cloud, PingFederate is easy to manage, with an intuitive administrative interface.”