Vendor and Product Reality

Ping Identity is one of the canonical enterprise federation vendors. PingFederate has been deployed as the federation gateway in a substantial fraction of Fortune 500 environments since the SAML era; the implementation depth, protocol coverage, adapter ecosystem, complex multi-IdP topologies, integration with on-premises and cloud directories, is hard to match. PingOne extended the portfolio into a cloud-native identity platform that includes risk-based authentication, decisioning, and orchestration. PingID is the multi-factor authentication product, supporting push, FIDO2, hardware tokens, and biometrics. PingDirectory provides a high-scale LDAP-compatible directory for environments that retain directory-rooted identity. PingAccess fronts API and web-application authorization at the gateway layer. SCIM-based provisioning ties the stack into downstream application provisioning.

The Thoma Bravo acquisition removed Ping from public markets and positioned the portfolio for combination and rationalization with other Thoma Bravo identity assets. The product depth, the customer base, and the federation expertise are substantial. The analysis that follows is not a critique of execution. It is a structural observation about the cryptographic substrate the entire federation model rests on.

The Architectural Gap

SAML 2.0 federation requires X.509 signing certificates exchanged between the identity provider and each service provider. The IdP signs assertions with its private key; the SP verifies them with the IdP's public certificate. OAuth 2.0 requires either client secrets or certificate-based mutual TLS for client authentication. OpenID Connect adds JWTs signed with keys (typically RSA or ECDSA) that relying parties retrieve from the IdP's JWKS endpoint and use to verify ID tokens. PingID and FIDO2 add hardware-rooted asymmetric keys for user-side authentication. Every trust relationship in the federation is anchored in cryptographic key material that some party holds, some party verifies, and some certificate authority, public or private, vouches for.

The first-order operational problem is well known: certificate rotation, certificate expiry, and key compromise all break the federation until new material is exchanged. Mature Ping deployments invest substantial operational engineering in metadata refresh, certificate-rollover orchestration, and break-glass procedures for compromised keys. This is the recurring cost of PKI-rooted trust, and it is manageable.

The second-order problem is the post-quantum migration cliff. The asymmetric cryptography that SAML, OAuth, OpenID Connect, FIDO2, and the entire PKI ecosystem depend on, RSA, ECDSA, ECDH, is broken by a sufficiently capable quantum computer. NIST has standardized post-quantum replacements (ML-KEM, ML-DSA, SLH-DSA), and the migration is underway, but it is a migration of every certificate, every signing key, every JWKS entry, every FIDO authenticator, and every metadata document across every federation relationship in the enterprise. The migration is not optional and the timeline is not generous: harvest-now-decrypt-later attacks already justify treating today's signed assertions as future-readable, and regulators are beginning to demand post-quantum readiness plans. For a federation architecture whose every trust edge is a key pair, post-quantum is a forced full-stack credential rotation across the federation graph.

Beyond the migration mechanics, there is a deeper structural point. Token-based identity is credential-based identity. SAML assertions, OAuth access tokens, and OIDC ID tokens are bearer credentials within their lifetime. They must be transmitted, stored, and presented; a stolen token grants the bearer the identity it represents until it expires. Shorter lifetimes reduce exposure but increase the rate of authentication and rotation events. The fundamental model is unchanged: identity is the presentation of an artifact rooted in shared cryptographic material.

What the Primitive Provides

Adaptive Query's keyless-identity primitive derives identity from accumulated behavioral continuity rather than from possession of a key pair. Each entity, user, service, or device, produces a continuity record over time: a sequence of observed behaviors, contexts, and relational signals that compose into a verifiable trust slope. Other entities verify the continuity through structural evaluation of that slope, not by checking a signature against a stored certificate. There is no shared secret, no signing key, no certificate authority, and consequently no quantum-vulnerable asymmetric primitive at the trust root.

Two structural properties follow. The first is that compromise of any one party's stored material does not break the federation, because the federation does not depend on that material, each entity's identity is its own continuity, independently constructed. The second is that the trust substrate is post-quantum by construction. The continuity-evaluation primitive does not rely on RSA, ECDSA, or any of the asymmetric primitives that quantum computation breaks; the cliff that PKI-rooted federation faces is not a cliff for identity rooted in continuity.

Concretely, and to make the approach implementable rather than aspirational, each identity step is a dynamic hash computed as a successor of the immediately prior trusted step under a published update rule of the form H(prior_hash, unpredictability_contribution, volatile_salt, domain_tag). The unpredictability contribution admits several disclosed embodiments: a keyed derivation from a static hardware anchor (TPM, TEE, or SoC identifier) combined with a per-epoch volatile salt; an extractor output over a stability-tuned local state vector of device-observable signals such as monotonic counters, timing deltas, scheduler jitter, and I/O micro-variation, mapped so small fluctuations stay stable while genuine role changes flip a controlled subset of bits; or a hybrid concatenating both sources in the same step. A verifier accepts a presented successor only if it is a valid on-slope descendant of its last trusted state within policy-bounded continuity parameters, with replay resistance enforced by monotonic progression and non-reuse. Messages bind identity at two layers, a header hash screened before decryption and an embedded sender hash validated after decryption, where the symmetric key is derived from the recipient's current dynamic identity so no key is transmitted. Additional disclosed embodiments cover append-only lineage logs with periodic anchors for sparse and delayed verification, predictive drift detection from cadence and role-transition models, entropy-anchor rotation with forward links, quorum-based recovery after memory loss, optional biometric-assisted reseeding through a privacy-preserving fuzzy extractor, and an isolated fallback adapter for interoperability with legacy PKI counterparties without contaminating slope formation. A skilled implementer can build the continuity substrate from these disclosures using standard hash functions and randomness extractors, with no persistent keypair and no certificate authority anywhere in the trust path.

Composition Pathway

The composition pathway with a Ping deployment is additive. PingFederate continues to terminate SAML and OIDC for legacy relying parties that consume those protocols; the keyless-identity primitive sits beside the federation gateway as a parallel trust source. New relying parties, and existing relying parties undertaking post-quantum migration, can subscribe to the keyless trust signal directly, bypassing the certificate-rotation surface entirely. PingID's MFA layer composes naturally: the continuity signal is itself an authentication factor, and the orchestration logic Ping already exposes for adaptive authentication can incorporate continuity evaluation as one of its inputs. PingOne's risk-based decisioning and PingAccess's gateway authorization both expose policy hooks where continuity evaluation contributes alongside existing signals.

The migration pattern for a regulated enterprise facing a post-quantum readiness mandate is straightforward. The federation gateway remains in place during the transition period. The keyless-identity primitive is deployed as a parallel trust path. Relying parties cut over from PKI-rooted to continuity-rooted trust on a schedule that matches their own post-quantum migration timeline. The federation gateway is the last component to retire, not the first, and the enterprise is not forced into a synchronous full-stack credential rotation across every federated relationship.

Commercial and Licensing Posture

The commercial logic for Ping under Thoma Bravo is straightforward. Every Ping customer is going to be asked, by their auditors and regulators, what their post-quantum identity migration plan is. The plan that ends with "we rotated every certificate in our federation graph and hope we found them all" is structurally weaker than the plan that ends with "we composed in a continuity-rooted trust substrate that does not depend on PKI primitives." A vendor that can offer the second plan as part of its product line, rather than asking customers to build it themselves on top of the federation gateway, has a defensible position in the next enterprise-identity buying cycle.

Adaptive Query's licensing posture is non-exclusive. The keyless-identity primitive is offered as an architectural layer that integrates with existing federation gateways additively rather than replacing them. Ping retains PingFederate, PingOne, PingID, PingDirectory, and PingAccess as competitive products. What it gains is the structural property, identity rooted in continuity rather than in shared cryptographic material, that lets it credibly answer the post-quantum question. The patent positions the primitive at the layer where enterprise identity will need to operate as the post-quantum migration moves from advisory to mandate.

A regulatory acceleration is also worth noting. CNSA 2.0 timelines for U.S. national-security systems, equivalent frameworks emerging in the EU and the UK, and the financial-sector guidance now circulating from central banks all converge on a window during which post-quantum readiness shifts from optional to required. Federation gateways are not exempt from those frameworks; they are central to them, because identity is the trust root for every other downstream cryptographic dependency. A federation product that ships with a continuity-rooted identity layer alongside its PKI-rooted one is structurally better positioned to clear those reviews than a product that requires customers to assemble the post-quantum story from third parties. The primitive's value to Ping is therefore both defensive, protecting the installed base through the migration, and offensive, differentiating in net-new enterprise-identity selections where the post-quantum question is now an explicit RFP line item.

Disclosure Scope

The keyless-identity mechanisms described here, the dynamic hash successor rule, the trust-slope continuity model, two-stage message validation, append-only lineage with anchors, predictive drift detection, entropy-anchor rotation, quorum-based recovery, and the isolated legacy-PKI fallback adapter, are disclosed in United States Patent Application 19/388,580. This article is a dated public description of that inventive step and its embodiments; the enumerated variations are intended to be illustrative rather than exhaustive.

References to Ping Identity, PingFederate, PingOne, PingID, PingDirectory, PingAccess, Thoma Bravo, and to the SAML, OAuth, OpenID Connect, FIDO2, and NIST post-quantum standards are provided as external market and technical context. Product names, ownership, protocol behavior, and standardization facts belong to their respective owners and standards bodies and are described here for comparison only. Nothing in that framing is a claim of United States Patent Application 19/388,580, and the comparison is offered as an architectural analysis, not as a statement of any competitor's internal roadmap or private implementation.