Ping Identity alternatives: replacing PingFederate, PingOne and PingDirectory

Ping Identity is an enterprise identity suite, not a single product. Its pieces cover federation (PingFederate), a cloud identity platform (PingOne), a directory (PingDirectory or PingDS), MFA (PingID), access management (PingAM), identity data management (PingIDM) and orchestration (PingOne DaVinci). "Ping Identity alternative" therefore depends on which piece you are replacing.

Short answer: Keycloak and Casdoor replace PingFederate and most of PingOne's SSO functionality for applications. Entra ID and Okta replace the cloud platform for Microsoft-centric or workforce-heavy organizations. OpenLDAP or 389 Directory Server replace PingDirectory for directory-only needs. Most migrations replace one or two pieces first, not the whole suite.

What is in the Ping suite

Ping Identity has been privately held by Thoma Bravo since 2022, and its pricing is quote-based rather than published per user. That is part of why teams look for alternatives: the renewal has to be negotiated, and the suite is priced for enterprises.

Open-source alternatives

Casdoor

Casdoor covers the part most teams actually use: an identity provider for applications, with OpenID Connect, SAML 2.0, CAS, LDAP and RADIUS in one service. It includes organizations for B2B tenants, MFA, passkeys, SCIM provisioning, social login and an admin console.

It replaces PingFederate for application SSO and can replace PingDirectory for smaller directories. Self-host it for free, or run a dedicated instance on Casdoor Cloud from $6.67/month billed yearly with unlimited users.

Keycloak

Keycloak is the most established open-source identity server. It provides realms, clients, identity brokering, LDAP and AD federation, fine-grained authorization and a themable login page. It is a close functional match for PingFederate, with a Java SPI extension model instead of Ping's SDKs.

Choose Keycloak when you need deep customization or already have Java and Kubernetes operations experience.

authentik and Zitadel

Both are modern open-source identity platforms. authentik focuses on self-hosted deployments with proxy and forward-auth support, and Zitadel is built for B2B multi-tenant applications with daily-active-user pricing in its cloud.

They fit teams that want a smaller product than Ping with a modern UI, and are willing to adopt a younger ecosystem.

Cloud alternatives

• Microsoft Entra ID is the default if your users are already in Microsoft 365 and Active Directory. It covers SSO, MFA and conditional access; PingFederate's advanced federation scenarios are not always replicated.
• Okta Workforce is the closest like-for-like replacement for Ping's workforce identity business. Pricing starts at $6 per user per month with a $1,500 annual minimum, up to $17 for the broadest tier.
• Casdoor Cloud is the flat-price option: a dedicated instance with unlimited users, no per-connection fee, and the same protocols as the open-source edition.

What a migration actually involves

1. Inventory the Ping products in use. A PingFederate-only deployment is a different project from PingFederate plus PingDirectory plus PingID.
2. Export application connections. PingFederate stores SAML and OIDC connections as configuration; they must be recreated in the target as applications. There is no universal import format.
3. Move users from PingDirectory. Sync over LDAP into the new identity provider, or keep the directory and point the new provider at it.
4. Plan MFA re-enrollment. Moving away from PingID usually means users enroll a new factor. Budget support time.
5. Run in parallel. Point one application at the new provider, keep Ping for the rest, and cut over application by application.
6. Retire licences at renewal, not before. Keep Ping running until the last application and the last administrative workflow have moved.

Password hashes are the sensitive part. Whether users keep their passwords depends on whether the target can import PingDirectory's hash format; assume a reset or a staged cutover unless you have verified otherwise.

How to choose

FAQ

What is the best open-source alternative to PingFederate? Keycloak and Casdoor. Both support SAML and OIDC, with Keycloak offering deeper Java customization and Casdoor a lighter deployment with organizations, LDAP and RADIUS included.

Can I replace Ping Identity with Microsoft Entra ID? For Microsoft-centric organizations, often yes. Entra ID is weaker for some complex federation and partner scenarios that PingFederate handles, so inventory the connections first.

Does Ping Identity publish pricing? Ping Identity's enterprise pricing is quote-based. Okta, which competes in the same workforce market, publishes per-user list prices.

Can users keep their passwords when leaving Ping? Only if the target can import PingDirectory's password hash format. Verify before promising it; most migrations plan for a reset or a gradual cutover.

What about PingID MFA? Moving off PingID usually requires users to enroll a new MFA method. Casdoor, Entra ID and Okta all provide TOTP, push or passkey options.