Welcome!

Microservices Expo Authors: Elizabeth White, AppNeta Blog, Gopala Krishna Behara, Sridhar Chalasani, Tirumala Khandrika

Related Topics: @CloudExpo, Microservices Expo, Cloud Security

@CloudExpo: Article

Is SAML All You Need to Offer Business Customers SaaS Single Sign-on?

How many customers can you serve with it?

No.

SAML is a protocol, a language. Languages are great for communicating, but a certain language is only useful when communicating with other speakers of the same language.

In business, the value of a language is dependent on how big a share of your current and potential customers speak it. Your choice of language(s) can greatly affect what kind of business you can expect: doing business only in Finnish limits your market to 5 Million people, whereas English lets you address more than a Billion people. You have three options:

  1. Limit your market to only those who speak your language of choice
  2. Learn to speak more languages to address a bigger market
  3. Try to teach more potential customers your language of choice

I have never heard of a successful example of the last alternative in business, have you?

How big a share of your customers "speaks" SAML?
I am not aware of any independent research on SAML adoption, but the largest number of customers I have seen a SAML vendor report is about 800 (written in August 2012), which is a good number for any vendor focused on a very specific area. However, if we presume that the market leader has 800 customers and a market share between 10 and 20 percent, that would lead lead to a conclusion that somewhere around 5000 organizations have invested in SAML solutions. How many of those are in production, and to what extent is another question.

About 5000 organizations, is that much or not? Single sign-on starts having a major impact on the usability of SaaS applications when there are more than a handful of users within an organization. For many common SaaS applications (for instance HR, CRM and document management) that requirement is already met by organizations with 100 employees. According to US Census Bureau (2008), there are more than 100 000 enterprises with 100+ employees in US alone, and the figure for EU is about the same according to Eurostat. Based on these figures, there must be at least 500 000 enterprises of that size in the world. Obviously 5000 organizations is only a fraction of the total number of organizations who would need single sign-on to achieve satisfactory usability for SaaS applications.

For you as a SaaS provider, this means that a very small share of your potential customers currently speak SAML, unless you are focusing on very specific segments where the adoption is higher.

Can you teach your customers to speak SAML?
Your options for teaching customers to speak SAML are:

  1. Reselling some commercial SAML product
  2. Offering a SAML Identity Provider on your own, for example based on some open source software
  3. Reselling or hooking up with some Authentication-as-a-Service offering

When you evaluate these options, the most important criteria are how they affect your business:

  • your value proposal to your customers
  • your revenue and time to recurring revenue
  • your support costs

The core of the SaaS value proposal is simplicity. You tell your customers that you will run and maintain everything for them, and they only have to pay their bills. If you require your customer to get something else from somewhere else in order for your application to really work, then simplicity will suffer, both technically and business-wise.

Recurring revenue and loyalty is what SaaS is about. Your focus should be on engaging as many users as possible within each customer organization as soon as possible. The first hundred days is a well known time span for most people, from a newly elected American president to a new couple. If you or your customer spends that time installing and configuring some on-premise software to improve the usability of your SaaS application, then adoption and usage will suffer, which in the end means less revenue and more churn.

Some of your techies might tell you that they found this great piece of open source software, which they can develop into a SAML Identity Provider that you can give your customers for free. They are probably right. However, what about support? Is your core business to maintain free on-premise software? Do you have the resources and processes for it? Can your customers use your free SAML solution with other SaaS applications as well? Who will support that? Or should customers have one free SAML Identity Provider for each SaaS application?

From a business point of view, it obviously does not make sense for you as a SaaS vendor to try to teach your customers to speak SAML, and it is not very likely to succeed either, because it is usually the one with the money who calls the shots.

How can you offer business customers SaaS single sign-on?
First, let's have a look at what is really required. You need to know who the user is, which typically means information like:

  • name
  • organization
  • business unit
  • access rights
  • email
  • phone

Much of that information can be found in, or derived from, the user directory (AD, LDAP etc) of your customer organization. Your job is to get that information for a user who has authenticated against it, and transfer it to your application in a secure way. None of those steps involve rocket science. The trick is of course to do it in a way that requires as little deployment and maintenance work as possible, both from you and from your customers. That is essential to achieve rollout speed, high adoption and low support costs.

You  need a solution which supports SAML for customers wanting to use that, and a more simple way for the rest. As said before, the core of the SaaS value proposal is simplicity.  We have very good experience from using customers' existing intranet web servers to achieve similar functionality in a less complex way, a solution which practically any customer organization with 100 employees or more can roll out in hours  If you want to read more about such a solution, click here.

More Stories By Kjell Backlund

Kjell Backlund, CEO of Emillion, is a seasoned software business entrepreneur with over 20 years experience in international business. He founded Emillion in 2001, with the vision that automating sign-on and user management would be essential to the success of SaaS and Service Desk applications(www.emillion.biz).

@MicroservicesExpo Stories
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm. In his Day 3 Keynote at 20th Cloud Expo, Chris Brown, a Solutions Marketing Manager at Nutanix, will explore t...
The IT industry is undergoing a significant evolution to keep up with cloud application demand. We see this happening as a mindset shift, from traditional IT teams to more well-rounded, cloud-focused job roles. The IT industry has become so cloud-minded that Gartner predicts that by 2020, this cloud shift will impact more than $1 trillion of global IT spending. This shift, however, has left some IT professionals feeling a little anxious about what lies ahead. The good news is that cloud computin...
As Enterprise business moves from Monoliths to Microservices, adoption and successful implementations of Microservices become more evident. The goal of Microservices is to improve software delivery speed and increase system safety as scale increases. Documenting hurdles and problems for the use of Microservices will help consultants, architects and specialists to avoid repeating the same mistakes and learn how and when to use (or not use) Microservices at the enterprise level. The circumstance w...
SYS-CON Events announced today that Auditwerx will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Auditwerx specializes in SOC 1, SOC 2, and SOC 3 attestation services throughout the U.S. and Canada. As a division of Carr, Riggs & Ingram (CRI), one of the top 20 largest CPA firms nationally, you can expect the resources, skills, and experience of a much larger firm combined with the accessibility and attent...
SYS-CON Events announced today that HTBase will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. HTBase (Gartner 2016 Cool Vendor) delivers a Composable IT infrastructure solution architected for agility and increased efficiency. It turns compute, storage, and fabric into fluid pools of resources that are easily composed and re-composed to meet each application’s needs. With HTBase, companies can quickly prov...
Everyone wants to use containers, but monitoring containers is hard. New ephemeral architecture introduces new challenges in how monitoring tools need to monitor and visualize containers, so your team can make sense of everything. In his session at @DevOpsSummit, David Gildeh, co-founder and CEO of Outlyer, will go through the challenges and show there is light at the end of the tunnel if you use the right tools and understand what you need to be monitoring to successfully use containers in your...
What if you could build a web application that could support true web-scale traffic without having to ever provision or manage a single server? Sounds magical, and it is! In his session at 20th Cloud Expo, Chris Munns, Senior Developer Advocate for Serverless Applications at Amazon Web Services, will show how to build a serverless website that scales automatically using services like AWS Lambda, Amazon API Gateway, and Amazon S3. We will review several frameworks that can help you build serverle...
Buzzword alert: Microservices and IoT at a DevOps conference? What could possibly go wrong? In this Power Panel at DevOps Summit, moderated by Jason Bloomberg, the leading expert on architecting agility for the enterprise and president of Intellyx, panelists peeled away the buzz and discuss the important architectural principles behind implementing IoT solutions for the enterprise. As remote IoT devices and sensors become increasingly intelligent, they become part of our distributed cloud enviro...
@DevOpsSummit has been named the ‘Top DevOps Influencer' by iTrend. iTrend processes millions of conversations, tweets, interactions, news articles, press releases, blog posts - and extract meaning form them and analyzes mobile and desktop software platforms used to communicate, various metadata (such as geo location), and automation tools. In overall placement, @DevOpsSummit ranked as the number one ‘DevOps Influencer' followed by @CloudExpo at third, and @MicroservicesE at 24th.
By now, every company in the world is on the lookout for the digital disruption that will threaten their existence. In study after study, executives believe that technology has either already disrupted their industry, is in the process of disrupting it or will disrupt it in the near future. As a result, every organization is taking steps to prepare for or mitigate unforeseen disruptions. Yet in almost every industry, the disruption trend continues unabated.
In his General Session at 16th Cloud Expo, David Shacochis, host of The Hybrid IT Files podcast and Vice President at CenturyLink, investigated three key trends of the “gigabit economy" though the story of a Fortune 500 communications company in transformation. Narrating how multi-modal hybrid IT, service automation, and agile delivery all intersect, he will cover the role of storytelling and empathy in achieving strategic alignment between the enterprise and its information technology.
While DevOps most critically and famously fosters collaboration, communication, and integration through cultural change, culture is more of an output than an input. In order to actively drive cultural evolution, organizations must make substantial organizational and process changes, and adopt new technologies, to encourage a DevOps culture. Moderated by Andi Mann, panelists discussed how to balance these three pillars of DevOps, where to focus attention (and resources), where organizations might...
Microservices are a very exciting architectural approach that many organizations are looking to as a way to accelerate innovation. Microservices promise to allow teams to move away from monolithic "ball of mud" systems, but the reality is that, in the vast majority of organizations, different projects and technologies will continue to be developed at different speeds. How to handle the dependencies between these disparate systems with different iteration cycles? Consider the "canoncial problem" ...
In his session at 20th Cloud Expo, Scott Davis, CTO of Embotics, will discuss how automation can provide the dynamic management required to cost-effectively deliver microservices and container solutions at scale. He will discuss how flexible automation is the key to effectively bridging and seamlessly coordinating both IT and developer needs for component orchestration across disparate clouds – an increasingly important requirement at today’s multi-cloud enterprise.
The essence of cloud computing is that all consumable IT resources are delivered as services. In his session at 15th Cloud Expo, Yung Chou, Technology Evangelist at Microsoft, demonstrated the concepts and implementations of two important cloud computing deliveries: Infrastructure as a Service (IaaS) and Platform as a Service (PaaS). He discussed from business and technical viewpoints what exactly they are, why we care, how they are different and in what ways, and the strategies for IT to transi...
Thanks to Docker and the DevOps revolution, microservices have emerged as the new way to build and deploy applications — and there are plenty of great reasons to embrace the microservices trend. If you are going to adopt microservices, you also have to understand that microservice architectures have many moving parts. When it comes to incident management, this presents an important difference between microservices and monolithic architectures. More moving parts mean more complexity to monitor an...
All organizations that did not originate this moment have a pre-existing culture as well as legacy technology and processes that can be more or less amenable to DevOps implementation. That organizational culture is influenced by the personalities and management styles of Executive Management, the wider culture in which the organization is situated, and the personalities of key team members at all levels of the organization. This culture and entrenched interests usually throw a wrench in the work...
The Internet of Things is clearly many things: data collection and analytics, wearables, Smart Grids and Smart Cities, the Industrial Internet, and more. Cool platforms like Arduino, Raspberry Pi, Intel's Galileo and Edison, and a diverse world of sensors are making the IoT a great toy box for developers in all these areas. In this Power Panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists discussed what things are the most important, which will have the most profound e...
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm.
For organizations that have amassed large sums of software complexity, taking a microservices approach is the first step toward DevOps and continuous improvement / development. Integrating system-level analysis with microservices makes it easier to change and add functionality to applications at any time without the increase of risk. Before you start big transformation projects or a cloud migration, make sure these changes won’t take down your entire organization.