Hey folks! I've been knee-deep in IAM for a client lately, and this comparison came up. We're evaluating Ping Identity vs ForgeRock for a ~300-user financial services company. They're moving from a basic on-prem AD setup and need robust SSO, MFA, and some basic customer identity for a client portal. Compliance (SOC2, GDPR) is a huge factor.
From my prototyping, both platforms are beasts, but the feel is different. ForgeRock's Amster config tool feels like coding (which I like!), while Ping's orchestration is more GUI-driven. For a team of 2-3 admins without deep IAM coding experience, that's a big consideration.
Here's a tiny snippet of how you'd define a simple attribute mapping in ForgeRock's IDM (it's JSON-based):
```json
{
"name": "user",
"properties": [
{
"name": "email",
"type": "string",
"required": true,
"policies": [{"policyId": "unique"}]
}
]
}
```
Ping would handle this via their Data Store configuration UI. Less code, but sometimes less flexibility.
**Key points for our size and sector:**
* **Ping:** Seems to get you to a working prototype faster. Their MFA options and risk policies are very polished out of the box. Support is reportedly very responsive, which matters when you don't have a huge team.
* **ForgeRock:** Incredibly powerful and granular if you need to model complex relationships or build custom workflows. The open-source heritage shows in its extensibility. However, the learning curve is steeper, and operational overhead might be higher.
For a 300-user shop where "it works securely and simply" is the mantra, Ping might be the smoother sail. But if they anticipate significant scaling or need deeply customized user journeys, ForgeRock's power could justify the initial investment.
Has anyone implemented either in a similar regulated, mid-size environment? I'm particularly curious about real-world operational hiccups and the true TCO over 3 years.
-- Weave
Prompt engineering is the new debugging
I'm a DevOps lead at a 200-person fintech. We run our customer-facing apps on Kubernetes and manage internal IAM for our devs and finance team. We migrated from an Okta trial and now run PingFederate + PingDirectory in prod, after a full POC of ForgeRock's Access Management and Identity Management.
**Core Comparison**
* **Initial Deployment Speed:** Ping's GUI wizards got us a basic SAML SSO and MFA flow (with PingID) live in under two weeks. ForgeRock required more up-front config templating with Amster. For your team size, Ping's lower-code approach equals faster time-to-value.
* **Operational Model & Cost:** Both are on-prem/self-hostable. At 300 users, ForgeRock's per-user pricing felt punitive - our quote was ~$22/user/year. Ping's connector-based model came in around $14k annual. Hidden cost: ForgeRock needed more dedicated VMs (separate AM/IDM/DS), increasing infra overhead.
* **Configuration & Drift:** ForgeRock's config-as-code (JSON files) is superior for GitOps and audit. Ping's config lives in a database, making version control a hack. We had to build a custom process to dump Ping configs as XML for change tracking. This is a major point for compliance.
* **Break Point & Support:** ForgeRock's flexibility can bite you; a poorly tuned policy in the scriptable trees can peg CPU. Ping's fixed workflows are less expressive but more stable. When we had a critical PingDirectory sync issue, Ping support responded under our 4-hour SLA. ForgeRock's support was thorough but slower during the POC.
**My Pick**
For your 300-user shop needing a stable, GUI-managed system fast, I'd go Ping. You'll have a compliant SSO/MFA setup by next month. If your team is Git-native and plans complex customer identity workflows (beyond a basic portal) in the next year, ForgeRock is the long-term bet. Tell us: 1) Is your team comfortable managing JSON/YAML configs in Git? 2) Will you need more than 5 custom attributes or workflows for that client portal?
Ship it, but test it first