Midships Keycloak vs Ping Identity software

Ping licenses its software per stored identity. Midships Keycloak does not.

Ping licenses its self-managed identity software, including PingAM, PingDS and PingIDM, per managed identity, whether that identity is active or not. Midships Keycloak runs in the same kind of environment without that meter.

Compare five-year cost ↗Build or buy? ↗

At a glance

Midships Keycloak vs Ping Identity software.

	Ping Identity software	Midships Keycloak
Pricing basis	Managed (stored) identity, counted whether active or not¹	Annual subscription. No per identity or per device fees
Who operates it	Your team or a partner	Your team, Midships Guardian, or both
Where it runs	Your data centre or cloud	Your data centre or cloud
DevSecOps	Pipelines and configuration promotion typically built by you or your partner	Included: infrastructure as code, promotion pipelines, rollback
Standards	OIDC, OAuth 2.0, SAML 2.0, FIDO2	OIDC, OAuth 2.0, SAML 2.0, FIDO2²
Journeys	Configured in the product by specialists	Built with Caravel from a versioned specification, to Midships standards
Upgrades	Your programme, on the vendor's release cycle	Rehearsed upgrade patterns included in the accelerator
Exit	Licence renewal or a migration programme	Open source core you can keep running without Midships

As at October 2026. Numbered references link to the vendor's own documentation below.

01, Cost

Inactive customers still count.

Ping's licensing guide counts a managed identity as a unique identifier for a user, device or other object stored by the product, whether or not it is used. For a bank with millions of dormant customer records, that is a licence on data rather than on activity.

Midships Keycloak is priced on the deployment, not the directory. Model your own numbers in the Keycloak savings calculator.

02, Delivery

Buying a licence does not buy a platform.

We delivered and operated Ping and ForgeRock estates for banks for years. Out of the box, the software gives you powerful components. It does not give you production: environments, configuration as code, promotion between environments, high availability design and performance tuning all have to be engineered. In our experience that typically takes months, and each programme built its own pipelines, so we built an accelerator for Ping, including DevSecOps pipelines.

Midships Keycloak is the same idea taken to its conclusion: the subscription includes the production platform, so the programme starts with your journeys, not with the plumbing.

03, Journeys

Every journey to the same standard.

Authentication journeys are where identity programmes slip: each one hand-configured, tested differently, documented afterwards if at all. With Midships Keycloak, journeys are built with Caravel, our AI-led delivery framework, from a versioned specification and checked against the same tests, so every journey meets the same Midships standard.

04, Keep or move

You do not have to move to work with us.

If Ping remains the right platform for you, we will optimise, upgrade and support it as an independent specialist. If the economics say move, we migrate in stages without changing the systems that depend on identity. Either way the decision rests on your business case, not a reseller target. See Existing Ping estates.

Verdict

Which is right for you?

Choose Ping Identity (self-managed) if

your Ping estate is stable, the licence is affordable at your identity volumes, and your team has the skills to run it.

Choose Midships Keycloak if

renewal is approaching, your identity count keeps growing, or the cost of running Ping now outweighs what it gives you.

Common questions

Frequently asked questions.

Is Midships a Ping partner?

No. Midships is independent of Ping Identity and is not a Ping reseller. Our engineers hold more than 29 Ping certifications and we continue to support customer-owned Ping estates.

Can Keycloak replace PingAM and PingFederate?

For customer identity, in the bank estates we have assessed, usually yes: Keycloak covers OIDC, OAuth 2.0 and SAML federation, authentication journeys, MFA and token services. We confirm coverage against your journeys and integrations before recommending a move.

How long does a migration take?

It depends on journeys, integrations and how many systems consume identity. We plan migrations in stages with parallel running, so customer traffic moves only when compatibility is proven.

Sources

How we sourced this comparison.

Statements about other vendors come from their public documentation and pricing pages, checked in October 2026. Vendors change products and prices; confirm current terms with them. Product names are trademarks of their owners and are used only to identify those products. If you believe anything here is inaccurate, tell us at sales@midships.io and we will correct it.

More comparisons