PingFederate and PingOne, upgraded on a plan instead of a deadline.
We implement and upgrade PingFederate, move workloads to PingOne, and time upgrades around Ping's LTS and STS support rules. When agents need tokens, we configure Ping's Identity for AI and OAuth token exchange.
Cohash implements and upgrades Ping Identity software, mainly PingFederate, PingAccess and PingOne.
We plan upgrades against Ping's End of Life policy, which separates Long-Term Support and Short-Term Support versions. For AI agents, we configure Ping's Identity for AI, generally available since March 2026, and PingFederate 13.1 token exchange, which supports the Identity Assertion JWT Authorization Grant.
you probably need this if
PingFederate is several releases behind and the person who built it has left.
Nobody can say which PingFederate connections could move to PingOne and which have to stay.
A Ping End of Life date is setting your upgrade schedule instead of your own plans.
PingFederate upgrade plan checked against Ping's EOL tracker
Connection and OAuth client inventory with owners and certificate dates
Adapter and integration kit compatibility matrix for the target version
+ 3 more documents
who does it
PingFederate engineerPingOne and DaVinci orchestration developerPingAccess engineer
Certified Professional - PingFederate
Certified Professional - PingOne
24 Mar 2026Identity for AI generally available Agent IAM Core, Agent Gateway and Agent Detection (through PingOne Protect). source ↗
Jun 2026PingFederate 13.1 Redis cache storage for replay prevention, dynamic JWKs and session revocation. SP connections for OAuth token exchange, including ID-JAG. 13.1.3 shipped in September 2026. source ↗
18 Jun 2026Ping End of Life policy (current version) LTS versions get at least three years of active maintenance plus an optional paid year of Extended Limited Support. STS versions reach End of Life two years after the next version ships. source ↗
today · Oct 22, 2026
the story · ping identity estate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your Ping Identity estate, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · ping identity estate3 open
openPingFederate is several releases behind and the person who built it has left.
recurringNobody can say which PingFederate connections could move to PingOne and which have to stay.
blockedA Ping End of Life date is setting your upgrade schedule instead of your own plans.
exposure
PingFederate upgradesPingFederate configurationPingOne SSO, MFA and DaVinciDeciding what moves to PingOneIdentity for AIForgeRock estates
startrehearsehandover
Inventory and EOL check
Upgrade plan
PingOne split
Production cut-over
Agent tokens
we are here
ready to hand over
The cluster runs a version with a known support date, and certificate expiry no longer…
The shared secret is retired, and the partner sees which user and which agent each call…
PingFederate upgrade plan checked against Ping's EOL tracker
Connection and OAuth client inventory with owners and certificate dates
chapter 01 · where it hurts
Why teams reach out
PingFederate is several releases behind and the person who built it has left.
Nobody can say which PingFederate connections could move to PingOne and which have to stay.
A Ping End of Life date is setting your upgrade schedule instead of your own plans.
chapter 02 · what we change
How we solve it
PingFederate upgrades
PingFederate configuration
PingOne SSO, MFA and DaVinci
Deciding what moves to PingOne
Identity for AI
ForgeRock estates
chapter 03 · how it runs
Our approach
Inventory and EOL check
Upgrade plan
PingOne split
Production cut-over
Agent tokens
chapter 04 · where you end up
What changes
The cluster runs a version with a known support date, and certificate expiry no longer lands all at once.
The shared secret is retired, and the partner sees which user and which agent each call is for.
PingFederate upgrade plan checked against Ping's EOL tracker
Connection and OAuth client inventory with owners and certificate dates
what we do
Our Ping Identity work
6 kinds of Ping Identity work, each run by engineers who have done it on live tenants.
Upgrades planned against Ping's EOL tracker and rehearsed on a cloned environment, with adapters, integration kits and custom code checked first.
SP and IdP connections, OAuth clients, access token managers and authentication policies, documented so the next admin can follow them.
PingOne sign-on and MFA, with DaVinci flows for registration, recovery and step-up. We keep flows small and versioned.
An inventory of what runs in PingFederate today, what moves to PingOne, and what stays put because of hosting or latency needs.
Agent IAM Core, Agent Gateway and Agent Detection in PingOne Protect, set up so each agent has its own identity and its actions are authorized at runtime.
PingAM, PingIDM and PingDS upgrades for teams that inherited ForgeRock. See our ForgeRock page for the 7.5 to 8.x path.
capability 01 / 06in production
PingFederate upgrades
Upgrades planned against Ping's EOL tracker and rehearsed on a cloned environment, with adapters, integration kits and custom code checked first.
Agent IAM Core, Agent Gateway and Agent Detection in PingOne Protect, set up so each agent has its own identity and its actions are authorized at runtime.
We pieced these together from Ping Identity situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
PingFederate two major versions behind, with 600 SP connections
composite · not a client story
Beforethe situation
A PingFederate cluster sits two major versions behind with about 600 SP connections and an in-house custom adapter. Its signing certificates all expire in the same month, and the upgrade has been deferred twice.
What we dothe work
We clone the cluster into a test environment and check every adapter and integration kit against the target version. Where the custom adapter's APIs changed, we rebuild it. Certificate rollover gets staggered and announced to SP owners ahead of time, and the upgrade is rehearsed with timings before the production window.
Afterwhere you end up
The cluster runs a version with a known support date, and certificate expiry no longer lands all at once. The custom adapter has source control and tests.
case file 02
An agent that has to call APIs in a partner's trust domain
composite · not a client story
Beforethe situation
An internal AI agent needs to call a partner's API on a user's behalf. The partner runs its own authorization server, and the current workaround is a shared client secret stored in the agent's configuration.
What we dothe work
We set up OAuth token exchange in PingFederate 13.1 with the Identity Assertion JWT Authorization Grant, so the agent swaps an assertion about the user for a token from the partner's server. Scopes are agreed with the partner, and Identity for AI registers the agent as its own identity.
Afterwhere you end up
The shared secret is retired, and the partner sees which user and which agent each call is for. The agent's access can be cut off without touching anyone else.
We don't start a step until the last one has produced something you can check.
step 01
Inventory and EOL check
We list SP and IdP connections, OAuth clients, adapters and integration kits, and place your version on Ping's End of Life tracker as LTS or STS.
step 02
Upgrade plan
A target version picked for its support window, adapters and custom code checked against the release notes, and Ping's upgrade utility run on a cloned environment first.
step 03
PingOne split
Each workload marked to move to PingOne, stay in PingFederate or retire. DaVinci flows replace custom registration and recovery code where they fit.
step 04
Production cut-over
The cluster upgraded in Ping's documented order with your team, connections tested from both sides, and the rollback kept ready until owners sign off.
step 05
Agent tokens
Where agents need cross-domain access, PingFederate 13.1 token exchange and Identity for AI are configured, with each agent given its own client and scopes.
ai on ping identity
Where AI fits on Ping Identity, and where it needs guardrails.
Ping's Identity for AI went GA in March 2026, with Agent IAM Core, Agent Gateway and Agent Detection. PingFederate 13.1 adds OAuth token exchange with ID-JAG, so an agent can reach APIs in another trust domain on a user's behalf. There's also a PingOne MCP server in preview. We give each agent its own client and scopes, and retire the shared secrets.
AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
Ping Identitydoes the work
The PingOne MCP server from Ping is in preview. It's read-only by default and signs in as the user through OAuth, with PKCE or device flow. For production agents we'd use PingFederate or PingOne APIs instead, with a dedicated OAuth client per agent and narrow scopes. Writes get logged and approved.
Identity for AI
In Ping's setup, agents get their own identities from Agent IAM Core, and Agent Gateway authorizes their actions at runtime. Agent Detection runs through PingOne Protect. We register agents with owners and decide which calls go through the gateway first.
Token exchange with ID-JAG in PingFederate 13.1
PingFederate 13.1 supports the Identity Assertion JWT Authorization Grant through OAuth token exchange. In our setup an agent swaps a user assertion for a token from a partner's authorization server. The scopes are agreed with that partner.
PingOne MCP server (preview)
Ping's PingOne MCP server lets an assistant review and manage PingOne tenants with the signed-in user's rights. Unless a flag enables writes, it's read-only. Ping says not to use it in production. We'd keep it for configuration review in development tenants.
AI help with PingFederate upgrades
Upgrades need a compatibility matrix. An AI assistant can compare adapter and integration kit versions with the release notes and draft it. Engineers confirm every entry and rehearse the upgrade on a cloned environment first.
How PingFederate and PingOne broker sign-in across trust domains
Workforce users and agents come in through PingFederate, which checks directories and then issues SAML assertions, OIDC tokens and exchanged tokens for APIs in other domains. Internal web apps sit behind PingAccess. Customer sign-in runs on PingOne with DaVinci flows.
These are working documents, written against your configuration, so your team can run them without us.
plan01
PingFederate upgrade plan checked against Ping's EOL tracker
yours to keep
inventory02
Connection and OAuth client inventory with owners and certificate dates
yours to keep
document03
Adapter and integration kit compatibility matrix for the target version
yours to keep
document04
App-by-app placement decision between PingFederate and PingOne
yours to keep
tests05
DaVinci flow library, versioned, with test cases
yours to keep
design06
Token exchange design for agents that cross trust domains
yours to keep
talent and delivery · ping identity
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Put these to anyone bidding on your Ping Identity work. The ones who've done it answer differently from the ones who've read about it.
Q1
Should we standardize on LTS versions, and which ones are LTS today?
Ping gives LTS versions at least three years of Active Maintenance, while STS versions reach End of Life two years after the next version ships. Teams that upgrade rarely save effort on LTS.
Q2
How will you check our adapters and integration kits before the upgrade?
Adapters and kits have their own version support. One unsupported kit can block the whole upgrade, so the compatibility matrix comes first.
Q3
Which applications should move to PingOne, and which stay on PingFederate?
PingOne removes server upkeep, but strict hosting rules, heavy customization and high on-premises throughput can favor PingFederate. Deciding app by app avoids a migration that stalls halfway.
Q4
How will agents get tokens for APIs that sit in another trust domain?
PingFederate 13.1 supports ID-JAG through OAuth token exchange. The usual alternative, a shared client secret, hides who the agent acted for.
Q5
How will DaVinci flows be versioned and tested?
A flow edited live in the console changes sign-in for everyone at once. Versioning and test cases make registration and recovery changes reviewable.
01How does Ping's LTS and STS policy affect our upgrade plan?
LTS versions stay in active maintenance for at least three years, and you can buy one more year of Extended Limited Support on top. STS versions get maintenance releases for a year after the next version ships, followed by a year of End of Maintenance. If upgrades are rare in your shop, standardize on LTS. Ping's EOL tracker has the dates for each product.
02Should we move from PingFederate to PingOne?
Sometimes. PingOne removes server upkeep. PingFederate still suits deployments with strict hosting rules, heavy customization or high on-premises throughput. Plenty of teams run both, and the split is worth deciding app by app.
03What is ID-JAG and why does it matter for agents?
The Identity Assertion JWT Authorization Grant lets a client or AI agent exchange an identity assertion for an access token from a different authorization server. PingFederate 13.1 supports it through OAuth token exchange, so an agent can reach APIs in another trust domain on the user's behalf.
04Do you also support ForgeRock?
Yes. ForgeRock is now part of Ping Identity, and we upgrade and support PingAM, PingIDM and PingDS deployments.
05How long does a PingFederate upgrade take?
It depends on how many versions you are crossing, how many adapters and integration kits you run, and how much custom code there is. We clone the environment, rehearse the upgrade with timings, and base the estimate on that rehearsal.
services
Related services
Projects on Ping Identity usually end up touching one of these, so they're worth a look.
