PingAccess

Identity and access management/governance is being reshaped by cloud, mobile, and social computing, expanding IAM/IAG beyond internal users to business partners and customers. Organizations now face pressure to accelerate partner onboarding/offboarding, enable secure access to partner applications, manage access to cloud services, and integrate diverse customer login methods. As a result, cloud-based IAM has matured from an emerging alternative into a direct competitor to traditional IAM vendors—especially in federation and web access management (WAM). In this context, Ping Identity positions PingAccess as a replacement for legacy WAM products while emphasizing that cloud IAM should complement on-premises IAM by extending access securely to external users.

Ping Identity offers PingOne (cloud IAM), PingFederate (on-premises federation), and PingAccess (WAM for web and API access). PingAccess targets next-generation, multi-channel access control for browser and non-browser resources, including SaaS, on-premises web apps, mobile apps using REST APIs, and machine-to-machine use cases. Architecturally, it mirrors traditional WAM with a Java-based Policy Decision Point (PDP) and web-server agents/plugins as Policy Enforcement Points (PEPs), but delegates authentication to PingFederate. It supports OAuth 2.0 session tokens and can interoperate with third-party WAM session tokens to preserve seamless SSO during migration.

Key differentiators include simplified hybrid deployment, optional full on-premises operation (with cloud connectivity mainly required for defining or changing policies), and an API gateway feature for REST API policy enforcement. Policies can be role/attribute-based, include context signals (time, IP, request info), and support adaptive authentication with step-up controls mid-session. The offering includes scalability features (clustering, rate limiting, session controls), monitoring, audit trails, and SIEM/log integration. Strengths center on cloud IAM capabilities, hybrid SSO, and integration with Ping products and directories; challenges include reduced emphasis on exotic legacy platforms and an API gateway limited to REST.

• The “Computing Troika” described consists of cloud, mobile, and social computing.
• Cloud-based IAM is characterized as an established market competing directly with traditional IAM vendors.
• Ping Identity provides PingOne, PingFederate, and PingAccess as distinct products.
• PingAccess integrates with PingFederate, which acts as its authentication engine.
• PingAccess supports OAuth 2.0 session tokens.
• PingAccess integrates with third-party WAM product session tokens to enable seamless SSO across protected applications.
• PingAccess includes an API gateway feature for defining access control policies for REST-based APIs.
• PingAccess can be deployed fully on-premises for administration and enforcement, remaining functional without internet connectivity.
• PingAccess provides a security-hardened soft appliance and supports clustering with load balancing and failover.
• The API gateway capability is limited to REST web services.

• “Major shifts in IAM/IAG (Identity Access Management/Governance) have been underway for some time now.”
• “The good thing: There finally is strong demand not only from IT, Information Security, and Audit for IAM/IAG, but also from business.”
• “From the KuppingerCole perspective, Cloud IAM must be complementary to existing on-premises IAM, enabling organizations to seamlessly extend the reach of their IAM to new groups of external users.”
• “PingAccess is a solution that specifically focuses next-generation, multi-channel access management for web-based resources, be they browser based or not.”
• “PingAccess provides full compatibility with OAuth 2.0 session tokens.”
• “Traditional WAM products are not known for their ease of deployment and configuration, while PingAccess was designed from the ground up to avoid the need for custom development for all but the most specific requirements.”
• “Policies can include content rewriting, authentication requirements, identity attributes (be this role or attribute-based), OAuth token scope or HTTP request info.”
• “An example of such an adaptive authentication use case could be to step up to multi-factor authentication when an employee opens a session within the enterprise network, and then within the same authentication session moves to a less-trusted public network…”
• “Its hybrid approach makes it very easy to offer a seamless SSO user experience while offering some notable adaptive authentication security enhancements.”
• “Legacy applications still exist, but catering to these older systems should not come at the price of unnecessary complexity.”