Strategic Security: Web Single Sign-On

Inside the firewall, many companies have deployed single sign-on systems to cut down on the hassle of end users having to remember and care for multiple user names and passwords. With SSO, an employee logs in once with a set of corporate credentials (typically a user name and password), and the system automatically signs the person into her other applications.

Now, as companies engage with multiple software-as-a-service providers, they're caught trying to solve the same problem all over again. Case in point is Qualys, a vulnerability management vendor which is itself a SaaS provider. The company's employees have access to about a dozen online applications--and also need to handle that many credentials.

"It's a pain managing passwords across multiple accounts and remembering a bunch of URLs," says Hesh Issa, VP of operations at Qualys.

In the SaaS world, companies have two choices for Web-based SSO. The first is to set up individual connections with each SaaS vendor, so that the same set of user credentials is automatically passed along to each SaaS application. This requires that IT use proprietary APIs from each vendor, or use one or more authentication standards, such as the Security Assertion Markup Language (SAML) specification, an Oasis standard that facilitates the exchange of authentication and authorization data among multiple parties.

The second option is to choose from a growing number of vendors that offer Web SSO as a software package or as a service.

These providers build back-end integrations with a variety of SaaS applications so that companies have to make only one connection--to the provider's service--to enjoy SSO for multiple Web applications. These providers use SAML, other standards such as WS-Federation, as well as vendors' proprietary APIs to enable SSO. Let's take a closer look at three of these companies--TriCipher, Symplified, and Ping Identity.

Sign Me Up
In the SaaS world, most of the activity around identity management focuses on single sign-on. There are two main reasons for this. First, enterprises know that SSO facilitates user adoption of applications and cuts down on the inevitable "I forgot my password" calls to the help desk.

Second, some major SaaS vendors, including Google, Salesforce.com, and WebEx, now support SAML. Last year, Salesforce announced it would enable use of SAML in addition to its own Web services API to let customers create one-off SSO implementations. The company says an increasing number of its customers are implementing SSO, although it declined to provide specific data.

Vendors offering Web SSO are taking advantage of this growing SAML adoption as a building block for their services. One of those vendors is TriCipher, which offers both premises- and SaaS-based authentication products. Its Web SSO offering, called MyOneLogin, was launched in February 2008.

Qualys turned to MyOneLogin for its 250 employees. MyOneLogin provides a Web portal where Qualys' users get icons for all their SaaS apps, as well as several internal Web applications, such as the company's code-versioning system and corporate wiki. Users click on the icon and are automatically signed in to the application.

DIG DEEPER

A Matter Of Trust

Identity management pays big dividends.

Find out how to get started.

See all our
InformationWeek Reports

MyOneLogin supports several options to pass credentials to applications, including SAML, WS-Federation, and APIs from major SaaS vendors. With the SAML option, when a user logs in to MyOneLogin and clicks on an app, the service generates a SAML assertion and signs it with its private key. It then sends the SAML assertion to the SaaS vendor, which verifies it via the MyOneLogin public key. Once the assertion is certified kosher, the user is given access to his application set.

If the SaaS vendor doesn't support SAML or another standard, the first time a user launches an application from the portal, he's prompted to enter his credentials, which the MyOneLogin service gathers up and stores for subsequent use. Some security teams will raise an eyebrow at the idea of having user names and passwords stored by TriCipher; however, the company is quick to point out that user credentials are stored on the company's ID Vault appliances, which are FIPS 140-2 Level 2-rated devices. FIPS 140-2 is a government standard for cryptography devices. The Level 2 designation means the device includes features, such as seals, that must be physically broken to get access to cryptographic keys.

In addition, the service is hosted from -- and ID Vault appliances are stored in -- a secure data center.

Proxy Approach
Another option comes from Symplified, a startup launched in 2006. Called SinglePoint, the company's SaaS-based service offers pre-built integrations with a long list of SaaS applications, including Concur, Google Apps, Salesforce, Workday, and others. Symplified supports SSO standards including SAML, and can also build integrations for SaaS sites that haven't embraced the standard.

Symplified's major distinction from other Web SSO services is that it proxies all connections to SaaS applications. An enterprise configures its DNS servers to route traffic for SaaS apps through Symplified's service. Subsequently, all traffic between the user and the application flows through Symplified's service. By acting as a proxy, Symplified can log all user activity, providing detailed audit trails of user behavior. Audits are a key requirement for Symplified's target market of highly regulated industries, including finance and pharmaceuticals.

The trade-off is that, as a proxy, Symplified runs the risk of introducing latency. CEO Eric Olden told us that the delay it introduces is in the milliseconds, and that the service can support 100 million transactions per day.

The service integrates with an enterprise portal or sets up a hosted portal where users go to access their Web applications. It provides SSO by accessing existing credential stores, typically via Active Directory or an LDAP server, using a Web service to communicate with the credential store. When users sign in to the portal, Symplified passes the user name and password along to all the employee's Web applications, so that users simply launch the services they want to use. Symplified passes the user name and password through its service, but Olden says the service doesn't store these credentials in its system.

If customers are uncomfortable with user names and passwords being sent through Symplified, they can deploy an Identity Router on their premises. The Identity Router connects to Active Directory and passes an identity token, rather than the actual credentials, out to the Symplified service.

That's the route Pfizer took. It had recently signed on to a SaaS application for 150 users in its global security group, but the SaaS vendor balked when the drugmaker requested that the vendor install software at its site.

"We use our premises SSO software to control authentication outside the DMZ," says Kurt Anderson of Pfizer's global operations business technology group. The SSO software sits at both sites to securely pass user credentials. But because the vendor didn't want to support this process, Pfizer began investigating other options, including Symplified.

The Essentials

Web Single Sign-On Services

1. Tricipher's MyOneLogin
A portal provides quick access for users to be automatically logged in to a variety of SaaS apps, but if the SaaS vendor doesn't support SAML, MyOneLogin stores user credentials, which may give some customers pause. 2. Symplified's SinglePoint
This SaaS service supports SSO for a long and growing list of Web apps and provides a premises option to keep credentials behind the firewall. However, the service proxies all connections, which may introduce latency. 3. Ping Identity's Ping Connect
An on-demand version of the company's premises SSO software, Ping Connect, gets users on Salesforce.com and Google Apps with a single login. At present, however, these are the only SaaS apps supported.

Anderson says the company's identity management administrators liked the Identity Router option because user names and passwords wouldn't have to be sent to Symplified.

While Pfizer's initial deployment is fairly small, Anderson says he can see the company using Symplified for other Web applications. "It adds another tool in the toolkit," he says.

Web SSO Two Ways
The third company making headway into the Web SSO market is Ping Identity. Ping has two options for Web SSO. The first is a software product, Ping Federate. Customers install the app on their corporate networks, where it connects to the local identity store, typically Active Directory or an LDAP server, and provides a gateway to SaaS apps. The software relies on SAML for Web SSO. Ping Identity says the software supports SSO for more than 50 SaaS vendors.

The second option is Ping Connect, which is an on-demand version of Ping Federate. The service, which is SAML-based, connects to the local directory at the customer premises. When a user logs in to Windows, the service takes that credential and signs the user in to the SaaS apps as well, so that when a user launches a browser and surfs to the SaaS site, she is already signed in.

At present, Ping Connect is compatible only with Google Apps and Salesforce, but the company says support for additional SaaS applications is forthcoming. A bonus: Because Ping Connect uses the local directory store, it can serve as an ad hoc provisioning/deprovisioning system. That is, as administrators add or remove users from the corporate directory, those changes will be propagated to SaaS applications. In addition, if an end user tries to access Salesforce or Google Apps while off the corporate network, they will be redirected to a corporate portal to log in before being granted access.

As more applications move to the Internet, companies can roll their own SSO connections to the cloud or sign on for a service, but they can't ignore the growing need to get a handle on user identities outside the firewall.

Our Take

SSO FOR SAAS MAKES SENSE