Product overview · 2 min read
PingFederate overview
Neutral overview. Twobo Technologies is not affiliated with, sponsored by or a reseller for Ping Identity or any other vendor. Product names belong to their owners; check the vendor's own documentation for current editions and licensing.
Short answer
PingFederate is Ping Identity's self-managed federation server: it acts as a SAML and WS-Federation identity provider and service provider, an OpenID Provider and an OAuth 2.0 authorization server, connecting to directories and authentication services through adapters, and is typically deployed as a clustered admin node plus runtime engines.
Key takeaways
- Deployed as software you run: one administrative console node and one or more runtime engines.
- Supports SAML 2.0, WS-Federation, OpenID Connect and OAuth 2.0, with adapters for directories and MFA.
- Harden it like any IdP: admin off the internet, allowlisted endpoints, security headers, patching.
PingFederate has been a common choice for enterprises that want to run their own federation server, connecting workforce and partner sign-in to hundreds of applications. This page describes it neutrally from public documentation.
What does PingFederate do?
It issues and consumes federation tokens: SAML and WS-Federation assertions, OpenID Connect ID tokens and OAuth access tokens.
| Role | Protocols |
|---|---|
| Identity provider | SAML 2.0, WS-Federation, OpenID Connect |
| Service provider | SAML 2.0, WS-Federation, OIDC (consuming upstream IdPs) |
| Authorization server | OAuth 2.0 grants, token introspection, JWKS |
| Integration | Adapters for directories, Kerberos, MFA services and applications |
How is it deployed?
As Java software on your own servers or containers: an administrative console node and runtime engine nodes, usually behind a load balancer or reverse proxy.
By default the admin console listens on port 9999 and the runtime on 9031. Configuration is replicated from the console node to engines. The vendor publishes container images and documents deployment on Kubernetes.
What should operators watch?
Admin exposure, endpoint surface, certificates and patch level.
See locking down a federation server and HSTS on Jetty-based servers. Test the assertions it issues with the SAML Decoder.
How does it relate to other Ping products?
PingOne is Ping Identity's cloud platform; PingFederate is the self-managed option; many deployments use both.
See the PingOne overview. Alternatives in the same category include other commercial federation servers, Microsoft AD FS and Entra ID, and open-source servers such as Keycloak and Shibboleth. The platform selection guide helps compare.
Questions
Who owns Ping Identity?
Ping Identity was acquired by Thoma Bravo in 2022, and ForgeRock was combined into Ping Identity in 2023 after Thoma Bravo acquired it.
What runs PingFederate's web server?
PingFederate runs on an embedded Jetty server. Current versions let administrators add custom response headers through configuration files, as described in the vendor's documentation.