Ping Identity’s PingFederate

Identity federation underpins Single Sign-On (SSO) across different domains and is widely used for mission-critical connections among universities, financial institutions, healthcare providers, e-commerce, government, and complex business ecosystems (e.g., suppliers, contractors, subsidiaries). The core use case enables users from one domain (e.g., Acme.com) to access another (e.g., Globex.com) using their existing credentials, avoiding duplicate accounts and multiple passwords. Beyond user convenience, federation reduces password exposure, improves security by centralizing account termination in the “home” domain, and lowers administrative overhead because Relying Parties depend on Identity Providers to manage identities and attributes. Federation can also bridge legacy Web Access Management (WAM) systems—even across different vendors—helping organizations avoid vendor lock-in and adapt faster during mergers, acquisitions, and divestitures.

PingFederate, Ping Identity’s flagship federation product, supports major standards including SAML, OAuth, OpenID Connect, JWT, WS-Federation, WS-Security, and WS-Trust. It can run on many operating systems and deploy on-premises, in cloud, or hybrid. PingFederate can act as IdP, SP, OAuth Authorization Server, OpenID Provider, identity bridge, federation hub, and Secure Token Service (STS) for policy-driven token transformation with attribute enrichment via JDBC, LDAP, REST APIs, or custom stores. It integrates with directories and authentication methods (AD, Azure AD, LDAP, RADIUS, X.509; Kerberos/LDAP/RADIUS authentication), multiple servers and WAM platforms, AWS services, and SIEM tooling (syslog, CEF, JMX, Splunk). Combined with PingID and broader Ping capabilities, it supports adaptive authentication policies and self-service features (registration, profile management, password reset, account unlock, username recovery), plus security controls like CAPTCHA and password-spraying prevention. Strengths include standards breadth, scalability, maintainability, and support; challenges include user management maturity, limited biometric MFA options, and missing onboarding workflows.

• Identity federation enables SSO between different domains and is used broadly across many industries for mission-critical applications.
• Federation allows users in one domain to access another domain without maintaining separate accounts or passwords in the target domain.
• Federation reduces the number of passwords users must remember, lowering the identity attack surface.
• Relying Parties depend on Identity Providers to maintain, update, and remove accounts, reducing duplicate account maintenance.
• Common federation-related standards include SAML, OAuth, OpenID, OpenID Connect, JWT, WS-Federation, and WS-Trust.
• Ping Identity was founded in 2002 and has more than 1,500 customers serving hundreds of millions of users.
• PingFederate can be deployed on-premises, in the cloud, or in a hybrid configuration.
• PingFederate can operate as IdP, SP, OAuth Authorization Server, OpenID Provider, identity bridge, and federation hub.
• PingFederate supports integrations with CA SiteMinder, Oracle Access Manager, and SAP NetWeaver via plugins that can read and write proprietary browser cookies.
• The latest version of PingFederate includes CAPTCHA integration and password-spraying prevention.

• “Identity federation is the foundational element for enabling Single Sign-On (SSO) between different domains.”
• “The classic federation use case is a set of users in one domain (Acme.com) leveraging their identity credentials and authentication events to gain access to another domain (Globex.com), without having to explicitly maintain distinct accounts, and login with different passwords.”
• “Identity federation is one of the main technologies that helps organizations move away from password-based authentication.”
• “Federation technology can bridge WAM systems, even between WAM systems from different vendors.”
• “Therefore, federation technology can help deploying organizations escape vendor lock-in, and more easily connect (or disconnect) entities involved in mergers, acquisitions, and divestitures.”
• “PingFederate is Ping Identity’s original solution for cross-domain SSO.”
• “In terms of federation server roles, PingFederate can operate as Identity Provider (IdP), Service Provider (SP), OAuth Authorization Server (AS), OpenID Connect Provider (OP), Identity Bridge, and Federation Hub.”
• “Single Log-Out (SLO) – one click to end federated sessions across all domains”
• “PingFederate can exchange incoming federation tokens for different kinds of outgoing federation tokens, depending on the requirements of the SP.”
• “Administrators can create rules and authentication chains for access to sensitive data.”