access management

PingFederate and PingOne, upgraded on a plan instead of a deadline.

We upgrade PingFederate, move what fits to PingOne, and plan each upgrade so a Ping End of Life date doesn't set your schedule. When agents need tokens, we set up Identity for AI and OAuth token exchange.

Talk to a Ping Identity engineer What changed recently

platform dossierPing IdentityAccess management

PingFederate release: 13.1 (Jun 2026); latest patch 13.1.4 (Oct 2026)
Supported PingFederate versions: 12.2, 12.3 (LTS), 13.0, 13.1
Next End of Life: PingFederate 12.2, PingAccess 8.2, PingDirectory 10.2: Dec 2026
Latest PingFederate CVE: CVE-2026-20773, CVSS 4.0 8.5, fixed in 13.1, 13.0.2, 12.3.6, 12.2.8

release watch

PingFederate 12.2 End of LifeDec 2026
PingFederate 13.1.4, 13.0.6 and 12.3.9Oct 2026

connects with

in short·15-second read

Cohash implements and upgrades PingFederate, PingAccess and PingOne, and we plan each upgrade against Ping's LTS and STS End of Life dates.

The newest PingFederate patch is 13.1.4, and 12.2 reaches End of Life in December 2026. For AI agents, we set up Identity for AI and PingFederate 13.1 token exchange with ID-JAG.

you probably need this if

PingFederate is several releases behind and the person who built it has left.
Someone asked which PingFederate connections could move to PingOne, and nobody had an answer.
PingFederate 12.2 goes End of Life in December 2026 and the upgrade still isn't on anyone's calendar.

terms on this page Token ExchangeLTSOAuthIdentity providerMFA

Ask an engineer facts checked 2026-11-03

how it runs: 01Inventory and EOL check
02Upgrade plan
03PingOne split
04Production cut-over
05Agent tokens
you keep: PingFederate upgrade plan checked against Ping's EOL tracker
Connection and OAuth client inventory, with an owner and a certificate expiry date on each. Expiring certificates stop being a surprise.
Adapter and kit check: what runs on the target version, and what has to be replaced first
+ 3 more documents
who does it: PingFederate engineerPingOne and DaVinci orchestration developerPingAccess engineer Certified Professional - PingFederate Certified Professional - PingOne
platforms
proof: 5 case studies on this
background: field note · 20 minOkta vs Microsoft Entra ID for enterprise security. Start with what you already pay for

ping-identity · release timeline

24 Mar 2026 Identity for AI generally available Agent IAM Core and Agent Gateway are GA now, with Agent Detection running through PingOne Protect. Give each agent its own identity and its actions get authorized at runtime.
Jun 2026 PingFederate 13.1 Replay prevention, dynamic JWKs and session revocation can live in Redis now, and SP connections do OAuth token exchange with ID-JAG. Don't stop at the base release. 13.1.2 and 13.1.3 both fixed security problems.
18 Jun 2026 Ping End of Life policy (current version) LTS versions get at least three years of active maintenance, and you can buy one more year of Extended Limited Support. STS versions are done two years after the next version ships, so staying on STS means upgrading often.
Sep 2026 CVE-2026-20773 (SECADV054) Admins in some roles could use the expression-testing endpoint beyond what their role allows. Ping rates it 8.5 on CVSS 4.0. You're covered on 13.1, 13.0.2, 12.3.6 or 12.2.8 and later. Older lines got 12.1.11, 12.0.11 and 11.3.15.
Oct 2026 PingFederate 13.1.4, 13.0.6 and 12.3.9 Ping put out maintenance releases for every supported line. 13.0.6 and 12.3.9 get the JDBC driver and connection URL checks and the Bouncy Castle FIPS update that 13.1 got in 13.1.3. 13.1.4 is mostly bug fixes, like Kerberos requests that hung when another realm was down.
today · Nov 09, 2026
Dec 2026ahead PingFederate 12.2 End of Life Ping's EOL tracker puts End of Life for PingFederate 12.2 in December 2026, the same month as PingAccess 8.2 and PingDirectory 10.2. After that, a problem on 12.2 gets no fix from Ping. PingFederate 12.1 and 11.3 already went End of Life in June 2026.

the story · ping identity estate

From the first call to a setup your own team can run.

Here's what usually prompts a call about your Ping Identity estate, what we do about it and in which order, and where you end up.

01 · where it hurts02 · what we change03 · how it runs04 · where you end up

incident board · ping identity estate3 open

openPingFederate is several releases behind and the person who built it has left.

recurringSomeone asked which PingFederate connections could move to PingOne, and nobody had an answer.

blockedPingFederate 12.2 goes End of Life in December 2026 and the upgrade still isn't on anyone's calendar.

exposure

PingFederate upgradesPingFederate configurationPingOne SSO, MFA and DaVinciDeciding what moves to PingOneIdentity for AIForgeRock estates

startrehearsehandover

Inventory and EOL check

Upgrade plan

PingOne split

Production cut-over

Agent tokens

we are here

ready to hand over

The cluster now runs a version whose support date everyone knows.
The shared secret is gone.
PingFederate upgrade plan checked against Ping's EOL tracker
Connection and OAuth client inventory, with an owner and a certificate expiry date on…

chapter 01 · where it hurts
Why teams reach out
- PingFederate is several releases behind and the person who built it has left.
- Someone asked which PingFederate connections could move to PingOne, and nobody had an answer.
- PingFederate 12.2 goes End of Life in December 2026 and the upgrade still isn't on anyone's calendar.
chapter 02 · what we change
How we solve it
- PingFederate upgrades
- PingFederate configuration
- PingOne SSO, MFA and DaVinci
- Deciding what moves to PingOne
- Identity for AI
- ForgeRock estates
chapter 03 · how it runs
Our approach
- Inventory and EOL check
- Upgrade plan
- PingOne split
- Production cut-over
- Agent tokens
chapter 04 · where you end up
What changes
- The cluster now runs a version whose support date everyone knows.
- The shared secret is gone.
- PingFederate upgrade plan checked against Ping's EOL tracker
- Connection and OAuth client inventory, with an owner and a certificate expiry date on each. Expiring certificates stop being a surprise.

what we do

Our Ping Identity work

6 kinds of Ping Identity work, each run by engineers who have done it on live tenants.

Upgrades planned against Ping's EOL tracker and rehearsed on a cloned environment, with adapters, integration kits and custom code checked first.
SP and IdP connections, OAuth clients, access token managers and authentication policies, documented so the next admin can follow them.
PingOne sign-on and MFA, with DaVinci flows for registration, recovery and step-up. We keep flows small and versioned.
An inventory of what runs in PingFederate today, what moves to PingOne, and what stays put because of hosting or latency needs.
Agent IAM Core, Agent Gateway and Agent Detection in PingOne Protect, set up so each agent has its own identity and its actions are authorized at runtime.
PingAM, PingIDM and PingDS upgrades for teams that inherited ForgeRock. See our ForgeRock page for the 7.5 to 8.x path.

capability 01 / 06in production

PingFederate upgrades

Upgrades planned against Ping's EOL tracker and rehearsed on a cloned environment, with adapters, integration kits and custom code checked first.

talk to an engineer about this →

capability 02 / 06in production

PingFederate configuration

SP and IdP connections, OAuth clients, access token managers and authentication policies, documented so the next admin can follow them.

talk to an engineer about this →

capability 03 / 06in production

PingOne SSO, MFA and DaVinci

PingOne sign-on and MFA, with DaVinci flows for registration, recovery and step-up. We keep flows small and versioned.

talk to an engineer about this →

capability 04 / 06in production

Deciding what moves to PingOne

An inventory of what runs in PingFederate today, what moves to PingOne, and what stays put because of hosting or latency needs.

talk to an engineer about this →

capability 05 / 06in production

Identity for AI

Agent IAM Core, Agent Gateway and Agent Detection in PingOne Protect, set up so each agent has its own identity and its actions are authorized at runtime.

talk to an engineer about this →

capability 06 / 06in production

ForgeRock estates

PingAM, PingIDM and PingDS upgrades for teams that inherited ForgeRock. See our ForgeRock page for the 7.5 to 8.x path.

talk to an engineer about this →

typical situations

Ping Identity situations we walk into

We pieced these together from Ping Identity situations that come up a lot. They're patterns. You won't find a specific client in them.

case file 01

PingFederate two major versions behind, with 600 SP connections

composite · not a client story

Beforethe situation

A PingFederate cluster sits two major versions behind with about 600 SP connections and an in-house custom adapter. Its signing certificates all expire in the same month, and the upgrade has been deferred twice.
What we dothe work

We clone the cluster into a test environment and check every adapter and integration kit against the target version. Where the custom adapter's APIs changed, we rebuild it. Certificate rollover gets staggered and announced to SP owners ahead of time, and the upgrade is rehearsed with timings before the production window.
Afterwhere you end up

The cluster now runs a version whose support date everyone knows. Certificates expire on a staggered schedule instead of all in one month, and the custom adapter finally lives in source control with tests.

case file 02

The partner's API still trusts a secret sitting in a config file

composite · not a client story

Beforethe situation

An internal AI agent has to call a partner's API for a user. The partner runs its own authorization server, so for now the agent gets in with a shared client secret sitting in its config file.
What we dothe work

We turn on OAuth token exchange in PingFederate 13.1 with the Identity Assertion JWT Authorization Grant. Then the agent trades an assertion about the user for a token from the partner's server. We agree the scopes with the partner and register the agent in Identity for AI as its own identity.
Afterwhere you end up

The shared secret is gone. The partner can see which user and which agent sent each call, and if the agent misbehaves, we cut off its access without touching anyone else's.

case studies

Ping Identity case studies

All case studies

migration Identity and access

ForgeRock AM/IDM to PingOne Advanced Identity Cloud

Moving self-managed ForgeRock AM and IDM, now called PingAM and PingIDM, to PingOne Advanced Identity Cloud without breaking sign-in or provisioning.

read the case study

migration Identity and access

AD FS federation to Entra ID authentication

Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.

read the case study

upgrade Applications

Mobile apps for Android 16 KB pages, passkeys and store deadlines

We keep Android and iOS apps shippable as Google Play's target API and 16 KB page rules and Apple's SDK minimums change, and add passkey sign-in.

read the case study

approach

How a Ping Identity engagement runs

We don't start a step until the last one has produced something you can check.

step 01
Inventory and EOL check

We pull every SP and IdP connection, OAuth client, adapter and integration kit into one list. Then we look your version up on Ping's End of Life tracker, LTS or STS, and see how long it has left.
step 02
Upgrade plan

A target version picked for its support window, adapters and custom code checked against the release notes, and Ping's upgrade utility run on a cloned environment first.
step 03
PingOne split

Each workload marked to move to PingOne, stay in PingFederate or retire. DaVinci flows replace custom registration and recovery code where they fit.
step 04
Production cut-over

Your team and ours upgrade the cluster in the order Ping documents. Each connection gets tested from both sides, and the rollback stays ready until the app owners sign off.
step 05
Agent tokens

An agent that has to reach into another trust domain gets its own OAuth client and scopes. We set up PingFederate 13.1 token exchange for it and register it in Identity for AI.

ai on ping identity

Where AI fits on Ping Identity, and where it needs guardrails.

Ping's Identity for AI went GA in March 2026, with Agent IAM Core, Agent Gateway and Agent Detection. PingFederate 13.1 adds OAuth token exchange with ID-JAG, so an agent can reach APIs in another trust domain on a user's behalf. There's also a PingOne MCP server in preview. We give each agent its own client and scopes, and retire the shared secrets.

AI agentasks for data or an action

Scoped identityonly the access it needs

MCP serverthe one door into the platform

Logged, approveda person signs off on writes

Ping Identitydoes the work

The PingOne MCP server from Ping is in preview. It's read-only by default and signs in as the user through OAuth, with PKCE or device flow. For production agents we'd use PingFederate or PingOne APIs instead, with a dedicated OAuth client per agent and narrow scopes. Writes get logged and approved.

Identity for AI

In Ping's setup, agents get their own identities from Agent IAM Core, and Agent Gateway authorizes their actions at runtime. Agent Detection runs through PingOne Protect. We register agents with owners and decide which calls go through the gateway first.

Token exchange with ID-JAG in PingFederate 13.1

PingFederate 13.1 supports the Identity Assertion JWT Authorization Grant through OAuth token exchange. In our setup an agent swaps a user assertion for a token from a partner's authorization server. The scopes are agreed with that partner.

PingOne MCP server (preview)

Ping's PingOne MCP server lets an assistant review and manage PingOne tenants with the signed-in user's rights. Unless a flag enables writes, it's read-only. Ping says not to use it in production. We'd keep it for configuration review in development tenants.

AI help with PingFederate upgrades

Upgrades need a compatibility matrix. An AI assistant can compare adapter and integration kit versions with the release notes and draft it. Engineers confirm every entry and rehearse the upgrade on a cloned environment first.

architecture

Where sign-in goes: PingFederate, PingOne and the trust domains between them

Workforce users and agents come in through PingFederate, which checks directories and then issues SAML assertions, OIDC tokens and exchanged tokens for APIs in other domains. Internal web apps sit behind PingAccess. Customer sign-in runs on PingOne with DaVinci flows.

use cases

Typical Ping Identity projects

The work teams usually bring us, and the platforms Ping Identity has to talk to while we do it.

PIN-01 PingFederate is several versions behind and nobody wants to touch it common request
PIN-02 Someone wants PingFederate moved to PingOne, and nobody has said which apps should go common request
PIN-03 Agents call APIs that trust someone else's identity provider, and right now they get in with a shared secret common request
PIN-04 Registration and recovery have to be rebuilt, and nobody wants another custom app common request
PIN-05 After the ForgeRock merger you run both product families, and nobody has one upgrade plan for them common request

Ping Identity · connected platforms

ForgeRock (Ping)Okta Microsoft Entra ID SailPoint CyberArk Salesforce

you keep

What a Ping Identity engagement leaves behind

These are working documents, written against your configuration, so your team can run them without us.

plan01

PingFederate upgrade plan checked against Ping's EOL tracker
yours to keep
inventory02

Connection and OAuth client inventory, with an owner and a certificate expiry date on each. Expiring certificates stop being a surprise.
yours to keep
document03

Adapter and kit check: what runs on the target version, and what has to be replaced first
yours to keep
document04

A call on each app: move it to PingOne, keep it on PingFederate or retire it.
yours to keep
tests05

DaVinci flow library, versioned, with test cases
yours to keep
design06

Token exchange design for agents that cross trust domains, with no shared client secrets left in config
yours to keep

talent and delivery · ping identity

Certified engineers, wherever you need them.

Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.

Onsite

Engineers at your sites in the US

Nearshore

Overlapping hours with US teams

Offshore

Overnight progress on your backlog

All time zones

Coverage handed over across time zones

24-hour coverage · US Central time

OnsiteUS business hours

Nearshoreoverlapping US hours

Offshoreovernight progress

Combinedhandover, not hand-off

certifications our engineers hold

Certified Professional - PingFederatePing Identity
Certified Professional - PingOnePing Identity
Certified Professional - PingOne DaVinciPing Identity
Certified Professional - PingAccessPing Identity

roles we staff

PingFederate engineer
PingOne and DaVinci orchestration developer
PingAccess engineer
PingDirectory administrator
Ping IAM architect

due diligence · ping identity

Questions to ask any partner, including us.

Put these to anyone bidding on your Ping Identity work. The ones who've done it answer differently from the ones who've read about it.

Q1
Should we standardize on LTS versions, and which ones are LTS today?
LTS versions get at least three years of Active Maintenance. STS versions hit End of Life two years after the next version ships, which is fine if you upgrade often and painful if you don't. For PingFederate, 12.3 is the LTS line today.
Q2
How will you check our adapters and integration kits before the upgrade?
Adapters and kits carry their own support dates, separate from PingFederate's. One kit that won't run on the target version can stall the whole upgrade, so we build the compatibility matrix first.
Q3
Which applications should move to PingOne, and which stay on PingFederate?
PingOne removes server upkeep, but strict hosting rules, heavy customization and high on-premises throughput can favor PingFederate. Deciding app by app avoids a migration that stalls halfway.
Q4
Our agents need tokens for a partner's API. How do we stop sharing a secret with them?
PingFederate 13.1 handles ID-JAG through OAuth token exchange. Without it, teams usually fall back on a shared client secret, and then nobody can tell which user the agent was acting for.
Q5
How will DaVinci flows be versioned and tested?
A flow edited live in the console changes sign-in for every user the moment it's saved. We version flows and keep test cases, so someone reviews a registration or recovery change before users see it.

01How does Ping's LTS and STS policy affect our upgrade plan?

LTS versions stay in active maintenance for at least three years, and you can buy one more year of Extended Limited Support on top. STS versions get maintenance releases for a year after the next version ships, followed by a year of End of Maintenance. If upgrades are rare in your shop, standardize on LTS. Ping's EOL tracker has the dates for each product.

02Should we move from PingFederate to PingOne?

Sometimes. PingOne takes server upkeep off your plate. If you have strict hosting rules, a lot of customization or heavy on-premises traffic, PingFederate usually still fits better. Plenty of teams run both, so decide it one app at a time.

03What is ID-JAG and why does it matter for agents?

ID-JAG is short for Identity Assertion JWT Authorization Grant. Say an agent works for a user and needs a partner's API, and that API trusts a different authorization server. The agent hands over an identity assertion and gets an access token back from that server. PingFederate 13.1 does this through OAuth token exchange, so nobody has to paste a shared secret into the agent's config.

04Do you also support ForgeRock?

Yes. ForgeRock belongs to Ping Identity now, so its products carry Ping names. If you inherited a ForgeRock estate, we upgrade and support PingAM, PingIDM and PingDS.

05How long does a PingFederate upgrade take?

It depends on how many versions you are crossing, how many adapters and integration kits you run, and how much custom code there is. We clone the environment, rehearse the upgrade with timings, and base the estimate on that rehearsal.

06Which PingFederate versions are still supported, and when does 12.2 reach End of Life?

Ping's EOL tracker still lists 12.2, 12.3, 13.0 and 13.1 as supported. 12.2 drops off in December 2026, so if you're on it, the upgrade belongs on this year's plan. 12.3 is the LTS line, with End of Life planned for June 2029.

07Which PingFederate versions fix CVE-2026-20773?

Ping fixed it in 13.1, 13.0.2, 12.3.6 and 12.2.8, plus 12.1.11, 12.0.11 and 11.3.15 for older lines. The bug lets admins in some roles run expression tests their role shouldn't allow. It needs an admin login, but it still scores 8.5 on CVSS 4.0, so patch and check who holds admin roles.

services

Related services

Projects on Ping Identity usually end up touching one of these, so they're worth a look.

you are herePing Identity

fact-checked Checked against vendor and official documentation last checked 2026-11-03 content fingerprint 1e90c99e

01Book a 30-minute working sessionsenior engineer
02Talk to an engineer about your setupreply within 24 hours
03See how similar projects wentcase studies

Reviewed by the Cohash team Ping Identity is a trademark of its owner, used here to identify the platform. how we handle facts and data →

PingFederate and PingOne, upgraded on a plan instead of a deadline.

From the first call to a setup your own team can run.

Why teams reach out

How we solve it

Our approach

What changes

Our Ping Identity work

PingFederate upgrades

PingFederate configuration

PingOne SSO, MFA and DaVinci

Deciding what moves to PingOne

Identity for AI

ForgeRock estates

Ping Identity situations we walk into

Ping Identity case studies

ForgeRock AM/IDM to PingOne Advanced Identity Cloud

AD FS federation to Entra ID authentication

Mobile apps for Android 16 KB pages, passkeys and store deadlines

How a Ping Identity engagement runs

Inventory and EOL check

Upgrade plan

PingOne split

Production cut-over

Agent tokens

Where AI fits on Ping Identity, and where it needs guardrails.

Identity for AI

Token exchange with ID-JAG in PingFederate 13.1

PingOne MCP server (preview)

AI help with PingFederate upgrades

Where sign-in goes: PingFederate, PingOne and the trust domains between them

Typical Ping Identity projects

What a Ping Identity engagement leaves behind

Certified engineers, wherever you need them.

Onsite

Nearshore

Offshore

All time zones

Questions to ask any partner, including us.

Should we standardize on LTS versions, and which ones are LTS today?

How will you check our adapters and integration kits before the upgrade?

Which applications should move to PingOne, and which stay on PingFederate?

Our agents need tokens for a partner's API. How do we stop sharing a secret with them?

How will DaVinci flows be versioned and tested?

Related services

Tell us what you're running. We'll tell you what we'd do first.