Welcome!

Microservices Expo Authors: Derek Weeks, PagerDuty Blog, Kevin Benedict, Yeshim Deniz, Elizabeth White

Related Topics: @CloudExpo, Microservices Expo, Cloud Security

@CloudExpo: Article

Is SAML All You Need to Offer Business Customers SaaS Single Sign-on?

How many customers can you serve with it?

No.

SAML is a protocol, a language. Languages are great for communicating, but a certain language is only useful when communicating with other speakers of the same language.

In business, the value of a language is dependent on how big a share of your current and potential customers speak it. Your choice of language(s) can greatly affect what kind of business you can expect: doing business only in Finnish limits your market to 5 Million people, whereas English lets you address more than a Billion people. You have three options:

  1. Limit your market to only those who speak your language of choice
  2. Learn to speak more languages to address a bigger market
  3. Try to teach more potential customers your language of choice

I have never heard of a successful example of the last alternative in business, have you?

How big a share of your customers "speaks" SAML?
I am not aware of any independent research on SAML adoption, but the largest number of customers I have seen a SAML vendor report is about 800 (written in August 2012), which is a good number for any vendor focused on a very specific area. However, if we presume that the market leader has 800 customers and a market share between 10 and 20 percent, that would lead lead to a conclusion that somewhere around 5000 organizations have invested in SAML solutions. How many of those are in production, and to what extent is another question.

About 5000 organizations, is that much or not? Single sign-on starts having a major impact on the usability of SaaS applications when there are more than a handful of users within an organization. For many common SaaS applications (for instance HR, CRM and document management) that requirement is already met by organizations with 100 employees. According to US Census Bureau (2008), there are more than 100 000 enterprises with 100+ employees in US alone, and the figure for EU is about the same according to Eurostat. Based on these figures, there must be at least 500 000 enterprises of that size in the world. Obviously 5000 organizations is only a fraction of the total number of organizations who would need single sign-on to achieve satisfactory usability for SaaS applications.

For you as a SaaS provider, this means that a very small share of your potential customers currently speak SAML, unless you are focusing on very specific segments where the adoption is higher.

Can you teach your customers to speak SAML?
Your options for teaching customers to speak SAML are:

  1. Reselling some commercial SAML product
  2. Offering a SAML Identity Provider on your own, for example based on some open source software
  3. Reselling or hooking up with some Authentication-as-a-Service offering

When you evaluate these options, the most important criteria are how they affect your business:

  • your value proposal to your customers
  • your revenue and time to recurring revenue
  • your support costs

The core of the SaaS value proposal is simplicity. You tell your customers that you will run and maintain everything for them, and they only have to pay their bills. If you require your customer to get something else from somewhere else in order for your application to really work, then simplicity will suffer, both technically and business-wise.

Recurring revenue and loyalty is what SaaS is about. Your focus should be on engaging as many users as possible within each customer organization as soon as possible. The first hundred days is a well known time span for most people, from a newly elected American president to a new couple. If you or your customer spends that time installing and configuring some on-premise software to improve the usability of your SaaS application, then adoption and usage will suffer, which in the end means less revenue and more churn.

Some of your techies might tell you that they found this great piece of open source software, which they can develop into a SAML Identity Provider that you can give your customers for free. They are probably right. However, what about support? Is your core business to maintain free on-premise software? Do you have the resources and processes for it? Can your customers use your free SAML solution with other SaaS applications as well? Who will support that? Or should customers have one free SAML Identity Provider for each SaaS application?

From a business point of view, it obviously does not make sense for you as a SaaS vendor to try to teach your customers to speak SAML, and it is not very likely to succeed either, because it is usually the one with the money who calls the shots.

How can you offer business customers SaaS single sign-on?
First, let's have a look at what is really required. You need to know who the user is, which typically means information like:

  • name
  • organization
  • business unit
  • access rights
  • email
  • phone

Much of that information can be found in, or derived from, the user directory (AD, LDAP etc) of your customer organization. Your job is to get that information for a user who has authenticated against it, and transfer it to your application in a secure way. None of those steps involve rocket science. The trick is of course to do it in a way that requires as little deployment and maintenance work as possible, both from you and from your customers. That is essential to achieve rollout speed, high adoption and low support costs.

You  need a solution which supports SAML for customers wanting to use that, and a more simple way for the rest. As said before, the core of the SaaS value proposal is simplicity.  We have very good experience from using customers' existing intranet web servers to achieve similar functionality in a less complex way, a solution which practically any customer organization with 100 employees or more can roll out in hours  If you want to read more about such a solution, click here.

More Stories By Kjell Backlund

Kjell Backlund, CEO of Emillion, is a seasoned software business entrepreneur with over 20 years experience in international business. He founded Emillion in 2001, with the vision that automating sign-on and user management would be essential to the success of SaaS and Service Desk applications(www.emillion.biz).

@MicroservicesExpo Stories
When building DevOps or continuous delivery practices you can learn a great deal from others. What choices did they make, what practices did they put in place, and how did they connect the dots? At Sonatype, we pulled together a set of 21 reference architectures for folks building continuous delivery and DevOps practices using Docker. Why? After 3,000 DevOps professionals attended our webinar on "Continuous Integration using Docker" discussing just one reference architecture example, we recogn...
Thanks to Docker and the DevOps revolution, microservices have emerged as the new way to build and deploy applications — and there are plenty of great reasons to embrace the microservices trend. If you are going to adopt microservices, you also have to understand that microservice architectures have many moving parts. When it comes to incident management, this presents an important difference between microservices and monolithic architectures. More moving parts mean more complexity to monitor an...
The evolution of JavaScript and HTML 5 to support a genuine component based framework (Web Components) with the necessary tools to deliver something close to a native experience including genuine realtime networking (UDP using WebRTC). HTML5 is evolving to offer built in templating support, the ability to watch objects (which will speed up Angular) and Web Components (which offer Angular Directives). The native level support will offer a massive performance boost to frameworks having to fake all...
All clouds are not equal. To succeed in a DevOps context, organizations should plan to develop/deploy apps across a choice of on-premise and public clouds simultaneously depending on the business needs. This is where the concept of the Lean Cloud comes in - resting on the idea that you often need to relocate your app modules over their life cycles for both innovation and operational efficiency in the cloud. In his session at @DevOpsSummit at19th Cloud Expo, Valentin (Val) Bercovici, CTO of Soli...
"We're bringing out a new application monitoring system to the DevOps space. It manages large enterprise applications that are distributed throughout a node in many enterprises and we manage them as one collective," explained Kevin Barnes, President of eCube Systems, in this SYS-CON.tv interview at DevOps at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
The rise of containers and microservices has skyrocketed the rate at which new applications are moved into production environments today. While developers have been deploying containers to speed up the development processes for some time, there still remain challenges with running microservices efficiently. Most existing IT monitoring tools don’t actually maintain visibility into the containers that make up microservices. As those container applications move into production, some IT operations t...
Docker containers have brought great opportunities to shorten the deployment process through continuous integration and the delivery of applications and microservices. This applies equally to enterprise data centers as well as the cloud. In his session at 20th Cloud Expo, Jari Kolehmainen, founder and CTO of Kontena, will discuss solutions and benefits of a deeply integrated deployment pipeline using technologies such as container management platforms, Docker containers, and the drone.io Cl tool...
For organizations that have amassed large sums of software complexity, taking a microservices approach is the first step toward DevOps and continuous improvement / development. Integrating system-level analysis with microservices makes it easier to change and add functionality to applications at any time without the increase of risk. Before you start big transformation projects or a cloud migration, make sure these changes won’t take down your entire organization.
SYS-CON Events announced today that CA Technologies has been named “Platinum Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY, and the 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business – from apparel to energy – is being rewritten by software. From ...
SYS-CON Events announced today that Outlyer, a monitoring service for DevOps and operations teams, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Outlyer is a monitoring service for DevOps and Operations teams running Cloud, SaaS, Microservices and IoT deployments. Designed for today's dynamic environments that need beyond cloud-scale monitoring, we make monitoring effortless so you...
DevOps is being widely accepted (if not fully adopted) as essential in enterprise IT. But as Enterprise DevOps gains maturity, expands scope, and increases velocity, the need for data-driven decisions across teams becomes more acute. DevOps teams in any modern business must wrangle the ‘digital exhaust’ from the delivery toolchain, "pervasive" and "cognitive" computing, APIs and services, mobile devices and applications, the Internet of Things, and now even blockchain. In this power panel at @...
Cloud Expo, Inc. has announced today that Andi Mann and Aruna Ravichandran have been named Co-Chairs of @DevOpsSummit at Cloud Expo 2017. The @DevOpsSummit at Cloud Expo New York will take place on June 6-8, 2017, at the Javits Center in New York City, New York, and @DevOpsSummit at Cloud Expo Silicon Valley will take place Oct. 31-Nov. 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
With 10 simultaneous tracks, keynotes, general sessions and targeted breakout classes, Cloud Expo and @ThingsExpo are two of the most important technology events of the year. Since its launch over eight years ago, Cloud Expo and @ThingsExpo have presented a rock star faculty as well as showcased hundreds of sponsors and exhibitors! In this blog post, I provide 7 tips on how, as part of our world-class faculty, you can deliver one of the most popular sessions at our events. But before reading the...
TechTarget storage websites are the best online information resource for news, tips and expert advice for the storage, backup and disaster recovery markets. By creating abundant, high-quality editorial content across more than 140 highly targeted technology-specific websites, TechTarget attracts and nurtures communities of technology buyers researching their companies' information technology needs. By understanding these buyers' content consumption behaviors, TechTarget creates the purchase inte...
@DevOpsSummit at Cloud taking place June 6-8, 2017, at Javits Center, New York City, is co-located with the 20th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long developm...
Microservices (μServices) are a fascinating evolution of the Distributed Object Computing (DOC) paradigm. Initial design of DOC attempted to solve the problem of simplifying developing complex distributed applications by applying object-oriented design principles to disparate components operating across networked infrastructure. In this model, DOC “hid” the complexity of making this work from the developer regardless of the deployment architecture through the use of complex frameworks, such as C...
DevOps and microservices are permeating software engineering teams broadly, whether these teams are in pure software shops but happen to run a business, such Uber and Airbnb, or in companies that rely heavily on software to run more traditional business, such as financial firms or high-end manufacturers. Microservices and DevOps have created software development and therefore business speed and agility benefits, but they have also created problems; specifically, they have created software securi...
Microservices are a very exciting architectural approach that many organizations are looking to as a way to accelerate innovation. Microservices promise to allow teams to move away from monolithic "ball of mud" systems, but the reality is that, in the vast majority of organizations, different projects and technologies will continue to be developed at different speeds. How to handle the dependencies between these disparate systems with different iteration cycles? Consider the "canoncial problem" ...
Both SaaS vendors and SaaS buyers are going “all-in” to hyperscale IaaS platforms such as AWS, which is disrupting the SaaS value proposition. Why should the enterprise SaaS consumer pay for the SaaS service if their data is resident in adjacent AWS S3 buckets? If both SaaS sellers and buyers are using the same cloud tools, automation and pay-per-transaction model offered by IaaS platforms, then why not host the “shrink-wrapped” software in the customers’ cloud? Further, serverless computing, cl...
Hardware virtualization and cloud computing allowed us to increase resource utilization and increase our flexibility to respond to business demand. Docker Containers are the next quantum leap - Are they?! Databases always represented an additional set of challenges unique to running workloads requiring a maximum of I/O, network, CPU resources combined with data locality.