Another option comes from Symplified, a startup launched in 2006. Called SinglePoint, the company's SaaS-based service offers pre-built integrations with a long list of SaaS applications, including Concur, Google Apps, Salesforce, Workday, and others. Symplified supports SSO standards including SAML, and can also build integrations for SaaS sites that haven't embraced the standard.
Symplified's major distinction from other Web SSO services is that it proxies all connections to SaaS applications. An enterprise configures its DNS servers to route traffic for SaaS apps through Symplified's service. Subsequently, all traffic between the user and the application flows through Symplified's service. By acting as a proxy, Symplified can log all user activity, providing detailed audit trails of user behavior. Audits are a key requirement for Symplified's target market of highly regulated industries, including finance and pharmaceuticals.
The trade-off is that, as a proxy, Symplified runs the risk of introducing latency. CEO Eric Olden told us that the delay it introduces is in the milliseconds, and that the service can support 100 million transactions per day.
The service integrates with an enterprise portal or sets up a hosted portal where users go to access their Web applications. It provides SSO by accessing existing credential stores, typically via Active Directory or an LDAP server, using a Web service to communicate with the credential store. When users sign in to the portal, Symplified passes the user name and password along to all the employee's Web applications, so that users simply launch the services they want to use. Symplified passes the user name and password through its service, but Olden says the service doesn't store these credentials in its system.
If customers are uncomfortable with user names and passwords being sent through Symplified, they can deploy an Identity Router on their premises. The Identity Router connects to Active Directory and passes an identity token, rather than the actual credentials, out to the Symplified service.
That's the route Pfizer took. It had recently signed on to a SaaS application for 150 users in its global security group, but the SaaS vendor balked when the drugmaker requested that the vendor install software at its site.
"We use our premises SSO software to control authentication outside the DMZ," says Kurt Anderson of Pfizer's global operations business technology group. The SSO software sits at both sites to securely pass user credentials. But because the vendor didn't want to support this process, Pfizer began investigating other options, including Symplified.
A portal provides quick access for users to be automatically logged in to a variety of SaaS apps, but if the SaaS vendor doesn't support SAML, MyOneLogin stores user credentials, which may give some customers pause. 2. Symplified's SinglePoint
This SaaS service supports SSO for a long and growing list of Web apps and provides a premises option to keep credentials behind the firewall. However, the service proxies all connections, which may introduce latency. 3. Ping Identity's Ping Connect
An on-demand version of the company's premises SSO software, Ping Connect, gets users on Salesforce.com and Google Apps with a single login. At present, however, these are the only SaaS apps supported.
While Pfizer's initial deployment is fairly small, Anderson says he can see the company using Symplified for other Web applications. "It adds another tool in the toolkit," he says.
Web SSO Two Ways
The third company making headway into the Web SSO market is Ping Identity. Ping has two options for Web SSO. The first is a software product, Ping Federate. Customers install the app on their corporate networks, where it connects to the local identity store, typically Active Directory or an LDAP server, and provides a gateway to SaaS apps. The software relies on SAML for Web SSO. Ping Identity says the software supports SSO for more than 50 SaaS vendors.
The second option is Ping Connect, which is an on-demand version of Ping Federate. The service, which is SAML-based, connects to the local directory at the customer premises. When a user logs in to Windows, the service takes that credential and signs the user in to the SaaS apps as well, so that when a user launches a browser and surfs to the SaaS site, she is already signed in.
At present, Ping Connect is compatible only with Google Apps and Salesforce, but the company says support for additional SaaS applications is forthcoming. A bonus: Because Ping Connect uses the local directory store, it can serve as an ad hoc provisioning/deprovisioning system. That is, as administrators add or remove users from the corporate directory, those changes will be propagated to SaaS applications. In addition, if an end user tries to access Salesforce or Google Apps while off the corporate network, they will be redirected to a corporate portal to log in before being granted access.
As more applications move to the Internet, companies can roll their own SSO connections to the cloud or sign on for a service, but they can't ignore the growing need to get a handle on user identities outside the firewall.
|
Companies have several choices for rolling out single sign-on to software-as-a-service and Web-based apps. Many SaaS providers offer APIs that let enterprises pass user credentials to the application when a user logs on to the corporate network. Enterprises can also leverage SAML to integrate SSO with SaaS vendors that support the standard.
|
The downside: Both these options require one-off connections with individual providers. As enterprises deploy more Web-based applications, it makes sense to investigate service providers that handle the back-end integration with a growing constellation of SaaS vendors.
|