I've been reading through the forum and the broader identity space for a while, trying to map out our options. We're a small team building a B2B SaaS product, and we need to manage customer identity (SSO, provisioning, that sort of thing) as part of a larger custom workflow system.
The obvious open-source choice seems to be Keycloak. It's free, and we can self-host. But I'm wary of the ongoing maintenance and hidden development time for integrating it into our specific onboarding and customer success flows. Ping Identity, on the other hand, is constantly mentioned as the enterprise standard.
For a team of our size, with limited DevOps bandwidth, is Ping's managed service a realistic consideration? The pricing is opaque, which is concerning. I'm trying to understand the actual time/cost trade-off.
My core question is about integration work. We need to pull user and login data into our analytics stack (basic SQL queries) and tie it to support tool events. Which platform would give us more straightforward access to that data and logs without building a ton of middleware? I've heard Ping's APIs are comprehensive but complex, while with Keycloak you're on the hook for building and maintaining the entire data pipeline yourself.
Any experiences from small teams who went one way or the other would be really helpful. I'm less interested in pure feature lists and more in the long-term burden of building and maintaining the integrations.
Hey there. I'm a solo dev/ops at a 30-person B2B SaaS shop, and I've wrangled both self-hosted Keycloak and PingOne in production for customer identity. Right now, we're running PingOne for our core product because we got a good deal, but I still have a Keycloak instance for internal apps.
Here's a breakdown from that specific experience, focused on your small team and need for data access.
* **Real Cost for 5 Engineers:** Ping's pricing is indeed opaque because it's enterprise sales. For a B2B SaaS use-case, they typically price per MAU. At my last shop, we paid about $0.08 to $0.12 per user per month on a 3-year commit for PingOne. For 10k users, that's ~$1k/month. Keycloak's direct cost is $0 for software, but factor in ~20-30 hours of initial DevOps time to containerize, configure DB/backups, and set up HA. Ongoing, it's 2-5 hours a month for updates/patching, which is your team's salary cost.
* **Integration & Data Access Effort:** For your analytics stack, Ping's APIs are a double-edged sword. They log everything, but pulling it means using their SCIM, Events API, and Directory API separately. You'll spend a week building a sync job to pipe that into your SQL. Keycloak has a single admin REST API and you can directly query its PostgreSQL database (if you self-host on your own DB). You can write a simple view for login analytics in an afternoon.
* **Where It Clearly Breaks:** Ping's breakage is in rigidity. Customizing the standard login widget beyond CSS is a non-starter; you need to build your own UI using their SDKs. For Keycloak, breakage is operational. A major version upgrade (like 21 to 22) can be a multi-day migration project with potential for theme or SPI breakage. You *will* need to babysit it.
* **Support & Hidden Time Sink:** With Ping, you get a dedicated TAM and support portal. Real response is 2-4 hours for P1. The hidden time is in meetings - sales engineers, quarterly reviews, renewal negotiations. With Keycloak, "support" is Stack Overflow and GitHub issues. The hidden time is your team digging through source code when something like a SAML nameID policy doesn't map as expected.
My pick for your team as described: start with **self-hosted Keycloak**. You need the direct database access for analytics and you have the engineering capacity (5 eng) to absorb the initial setup. The control over data flow will save you building middleware later.
If the choice isn't clear, tell us: 1) What's your absolute maximum monthly budget for this service, and 2) Do you need to support social logins (Google, GitHub) for your B2B customers, or only SAML/OIDC?
Integration Ian