Hi everyone. I'm still getting my feet wet with identity management, but I've been trying to understand Ping by looking at features vs what you actually do with them.
I made this simple table from my notes. Could you tell me if I'm on the right track? My main confusion is when you'd pick one feature over another for a real task.
| Feature I Read About | My Guess at a Concrete Use Case | What I'm Unsure About |
| :--- | :--- | :--- |
| Single Sign-On (SSO) | Users log into one portal, then access Salesforce and Slack without another password. | Is this just for web apps, or can it work for a custom API I'm building in Docker? |
| Multi-Factor Auth (MFA) | Require a code from a phone app *after* the password for the admin dashboard. | Do you usually turn this on for *every* user, or just for sensitive internal tools? |
| Directory Integration | Pull all employee accounts and groups from our company's Active Directory. | Does this mean Ping just mirrors AD, or can it be the main source of truth? |
| API Access Management | Let our mobile app (like a React Native frontend) securely talk to our backend microservices. | How does this setup differ from just using SSO? Is it about tokens vs. sessions? |
For the API case, I'm used to seeing Docker Compose files. Would the setup for a microservice to validate a Ping token look something like this in its config?
```yaml
# In a service's config file, not docker-compose
authentication:
provider: ping
jwks_uri: https://auth.company.ping.com/path/to/jwks
issuer: https://auth.company.ping.com
```
Is that the general idea? Thanks for helping a newcomer connect the dots
Containers are magic, but I want to know how the magic works.
1. I run ops for a 25-person SaaS shop and we deployed Ping Identity last year to handle customer and staff logins. We have it managing access to our internal admin panel, a couple customer-facing apps, and some APIs.
2. Here's what I learned when we were comparing options:
- Target fit: Definitely enterprise-leaning. For our small team, the feature set was overkill. You feel the complexity in the admin console. A simpler IdP like Okta or even Auth0 felt more SMB-friendly.
- Real pricing: They don't publish it. Our quote started around $5/user/month for core SSO but ballooned when we added API access and MFA policies. The final negotiated annual contract was roughly $8/user/month for our bundle.
- Deployment effort: Heavy. It took us about six weeks from signing to full rollout, mostly due to configuring SAML connections and syncing from our Azure AD. The directory integration is powerful but you'll spend days in the docs.
- Where it breaks: Custom API flows. SSO works great for web apps. For securing our own internal APIs (in Docker), we had to use their OAuth setup, which was a separate, more complex configuration. It's not just SSO for APIs.
3. My pick: If you're a small business with mainly web apps and need SSO/MFA, I'd start with Okta. It's more straightforward. Only go with Ping if you have a hard requirement for deep, policy-heavy directory integration and you have dedicated identity staff. To decide, tell us your team size and if you're mainly securing apps for employees or APIs for external developers.