The Ping Identity Directory Server offers a password retirement feature, which allows you to change the password for an account, but continue to use the previous password for a limited period of time. This is especially helpful for application accounts because it can help you avoid the race between changing an application account’s password and updating all instances of that application with the new credentials. I wrote about it on my personal blog at https://nawilson.com/2019/03/05/password-retirement-in-the-ping-identity-directory-server/.