Midships Keycloak vs PingOne Advanced Identity Cloud

PingOne Advanced Identity Cloud licenses customer identity per active user. Midships Keycloak does not.

PingOne Advanced Identity Cloud, formerly ForgeRock Identity Cloud, is a capable SaaS platform that Ping operates for you. Midships Keycloak supports the same open standards on a platform you run in your own environment, with a subscription that does not grow with your customer base.

Compare five-year cost ↗Build or buy? ↗

At a glance

Midships Keycloak vs PingOne Advanced Identity Cloud.

	PingOne Advanced Identity Cloud	Midships Keycloak
Pricing basis	CIAM licensed per Annual Active User; workforce per managed identity¹	Annual subscription. No per identity or per device fees
Who operates it	Ping, as a SaaS service	Your team, Midships Guardian, or both
Where it runs	Ping-operated cloud tenant	Your data centre or your own cloud tenancy
Environments	Development, staging and production included; extra UAT, sandbox and production tenants are add-ons¹²	As many as your design needs, built from the same code
Configuration promotion	Self-service promotion development to staging to production, in sequence³	Everything as code through your own pipelines, with rollback
Standards	OIDC, OAuth 2.0, SAML 2.0, FIDO2	OIDC, OAuth 2.0, SAML 2.0, FIDO2⁴
Extensibility	Journeys and scripts inside the platform	Full source access, SPI extensions, journeys built with Caravel to Midships standards
Exit	Configuration and identities move to a new platform through a migration programme	Open source core you can keep running without Midships

As at October 2026. Numbered references link to the vendor's own documentation below.

01, Cost

Your licence grows with your customers. Ours does not.

Ping licenses Advanced Identity Cloud for customer identity by Annual Active User: every identity that signs in, refreshes a token or changes a password at least once in the contract year counts once. Infrastructure add-ons such as additional production tenants, multi-region high availability and disaster recovery testing are listed separately. As your digital channels succeed, the bill rises with them.

Midships Keycloak is an annual subscription priced on the deployment you need, not on how many customers use it. Use the Keycloak savings calculator with your own licence figures, or the renewal planner if a renewal date is approaching.

02, Control

Your platform, your tenancy, your release calendar.

Advanced Identity Cloud is a SaaS service: Ping runs the infrastructure and the release channels. That suits organisations that want identity operated for them. It suits less well a bank that needs identity in its own data centre or cloud tenancy, under its own change control, with data residency it can evidence to a regulator.

Midships Keycloak runs where you choose: on premises or in your own cloud tenancy. You own the code, the configuration and the release calendar. Midships can operate it for you through Guardian, inside your tenancy.

03, Getting to production

Neither option is plug and play. One of them arrives built.

Every enterprise identity platform is a delivery programme: journeys, integrations, environments, performance tuning and operational runbooks. We know this from years of delivering ForgeRock and Ping for banks, with more than 29 Ping certifications across our team. In our experience, configuring, deploying and tuning a production estate on those platforms takes months, which is why we built an accelerator for Ping as well.

Midships Keycloak arrives with that work already done: infrastructure as code, high availability patterns, a hardened baseline, promotion pipelines and monitoring. New journeys are built with Caravel, our AI-led delivery framework, from a versioned specification and to the same Midships standards every time.

04, Migration

Change the identity platform, not the systems that depend on it.

We reproduce the token and API contracts your consuming applications rely on, run the old and new platforms in parallel, and move traffic in stages with rollback. In 2025 we completed four complex migrations and upgrades of bank identity estates, in four countries, all at tier 1 or tier 2 banks. A tier 1 bank in South East Asia is migrating to Midships Keycloak, with production go-live from December 2026.

See how we migrate and the CIAM Migration Diary.

Verdict

Which is right for you?

Choose Ping Advanced Identity Cloud if

you want identity fully operated as SaaS by the vendor, your active user numbers are stable, and data residency in your own tenancy is not a requirement.

Choose Midships Keycloak if

you want to own the platform, run it in your own environment, and stop paying more each time your digital channels grow.

Common questions

Frequently asked questions.

Is PingOne Advanced Identity Cloud the same as ForgeRock Identity Cloud?

Yes. Ping Identity acquired ForgeRock and renamed ForgeRock Identity Cloud as PingOne Advanced Identity Cloud.

Can Midships migrate us from Advanced Identity Cloud without changing our applications?

That is the design objective of every migration we run: reproduce the token and API contracts consuming applications depend on, prove compatibility in parallel, then move traffic in stages. Any exception is identified and agreed before traffic moves.

Does Midships still support Ping platforms?

Yes. Midships is independent of Ping Identity and is not a Ping reseller, and we continue to deliver and operate Ping environments for clients who keep them.

Is Keycloak secure enough for a bank?

Keycloak implements the same open standards, and Midships Keycloak adds a hardened baseline, audited pipelines and operating patterns drawn from our work on bank production identity estates. Security is evidenced through your own testing and assurance, as with any platform.

Sources

How we sourced this comparison.

Statements about other vendors come from their public documentation and pricing pages, checked in October 2026. Vendors change products and prices; confirm current terms with them. Product names are trademarks of their owners and are used only to identify those products. If you believe anything here is inaccurate, tell us at sales@midships.io and we will correct it.

More comparisons