PingAccess

Growing business demand for tighter collaboration with partners and customers is pushing IT to provide a consistent integration foundation for both inbound and outbound access across on-premises applications, cloud services, and mobile devices. Access Management and Identity Federation have shifted from tactical controls to strategic infrastructure because organizations must rapidly onboard external users, securely consume external services, and respond to changing attack vectors as the traditional network perimeter dissolves. While Web Access Management (WAM) remains important for legacy applications, modern standards such as OAuth 2.0 and OpenID Connect, plus capabilities like self-registration and reverse proxying, are increasingly expected.

Ping Identity, founded in 2002 with a focus on federation, has expanded into broader access capabilities and offers PingOne (cloud IAM), PingFederate (on-prem federation), and PingAccess (web and API access management). PingAccess targets next-generation, multi-channel access control for browser and non-browser use cases, including REST APIs used by mobile apps and IoT. Architecturally, it uses a Java-based Policy Decision Point (PDP) with web-tier Policy Enforcement Points (PEPs) via agents/plugins or an HTTP gateway. Policies can be role- or attribute-based and can incorporate authentication requirements, token scopes, network/time ranges, session signals, HTTP request/response attributes, and content rewriting; customization is supported via Groovy scripting or a Java SDK.

PingAccess supports identity mapping to backend apps via HTTP headers or JWTs (with encryption/validation) and includes an exclusion list to prevent specific attributes from being passed downstream. It enables adaptive authentication with mid-session step-up, API transactional authorization (including CIBA-based out-of-band step-up for high-risk actions), and administrative/policy-decision APIs. Deployment supports on-prem, cloud, hybrid, and container platforms, with improvements to configuration replication at scale (up to 100k objects). Security and operations features include HSM support (starting with AWS CloudHSM), ACME automation, PKCE, TLS 1.3, clustering, rate limiting, session revocation lists, metrics for tuning, auditing, heartbeat monitoring, and SIEM integrations such as Splunk. Key challenges include reliance on other Ping products for advanced WAM and risk/session attack detection, and an API gateway focus limited to REST.

• Ping Identity was founded in 2002 and initially focused on Identity Federation.
• Ping Identity’s main products include PingOne, PingFederate, and PingAccess.
• PingAccess supports access management for both web resources and REST API-based access.
• PingAccess uses a Policy Decision Point (PDP) server and Policy Enforcement Points (PEPs) via agents/plugins for web servers such as Microsoft IIS and Apache.
• Access policies can be role-based and attribute-based and defined at application and resource levels.
• PingAccess supports identity mapping to backend servers using HTTP headers or JWTs that it can decrypt and validate.
• PingAccess can store identity and session information in JWTs, sign them, and maintain session revocation lists.
• PingAccess supports Client Initiated Backchannel Authentication (CIBA) for out-of-band step-up authentication in high-risk API transactions.
• PingAccess supports Docker and Kubernetes deployment models.
• Configuration replication improvements can handle up to 100k objects and are described as a 10x scale improvement.

• “Access Management and Federation are moving from tactical IT challenges towards strategic infrastructure elements that enable business agility.”
• “At the core is the need for agility in a complex and competitive landscape.”
• “The changing workforce is also changing the idea that access to an organization’s resources can only be performed on-premises breaking down the traditional perimeter model.”
• “PingAccess is a solution that specifically focuses on next-generation, multi-channel access management for web-based resources, be they browser-based or not.”
• “Policies can include content rewriting, authentication requirements, identity attributes (be this role or attribute-based), OAuth token scope, or HTTP request info.”
• “Rewriting of the body of the HTML is possible as well.”
• “PingAccess can sign JWTs for higher security, and maintain and act upon session revocation lists.”
• “Transactional Authorization for API applications is also given.”
• “To avoid long replication time of PingAccess, Ping Identity has improved on its configurations at scale by a factor of 10x.”
• “Only the ability to define or change policies requires connectivity to Ping’s cloud infrastructure.”