Arbitrage

Salesforce.com and SAML for SSO

Flew under the radar a bit, but it is now official that Salesforce.com supports SAML for Single Sign On. This is great news for Salesforce.com customers – they now have an open industry standard for implementing SSO. The key benefit of using SAML instead of proprietary SSO is that with SAML the same solution a customer uses for SSO to Salesforce.com can be used with GoogleApps or any of the other hundreds of companies that now support the SAML standard. No more one offs for SSO.

In the bigger picture, the fact that the leading On Demand application has made the move to SAML is a signal that the SaaS/On Demand community is on the path of adopting common models for identity management and security in general. Really good stuff!

Identity and the Cloud – more detail

Part of my role at Ping Identity is to manage our partnerships with GoogleApps and Salesforce.com. In seeing the Identity requirements that enterprise IT shops are putting on those two SaaS leaders, it’s clear that the line between On Demand applications and On Premise applications is blurring and that a hybrid model is emerging where the goal is to more closely integrate Software as a Service applications and functionality into enterprise IT infrastructure. As SaaS vendors and their customers sort through the security implications of this hybrid On Demand slash On Premise model  for cloud applications, they face a number of very interesting Identity Management challenges.

The typical large enterprise IT shop has relatively mature production implementations for standard Identity Management functionality such as user authentication, single sign on, user management, provisioning/de-provisioning, and audit. Because these implementations were designed and deployed to support users accessing applications running inside the enterprise, they often do not transition well to a model that calls for users to access applications (such as Salesforce.com and GoogleApps) which are hosted outside the corporate firewall.  The result is that an IT shop that has deployed an effective common model for identity management within the enterprise sees that common model breakdown when requirements call for integration with On Demand applications. This breakdown comes in the form of proliferating On Demand user name and password accounts for users, manual processes for provisioning and de provisioning users to On Demand applications, limited audit visibility across On Demand, and constraints around data integration between external and internal applications.

One approach to these challenges is to move some Identity Management functionality to an On Demand model. Vendors such as Covisint, Conformity, TriCipher and now Ping Identity (through our acquisition of the Sxip Access hosted service) offer some aspect of Identity functionality through a hosted service. These services sit between a company and an On Demand vendor and broker Identity transactions such as authentication and user management. The value of a hosted service is it aggregates connections between companies and their SaaS vendors which diminishes the administrative hassles of managing many to many relationships on both sides. The limitation of a pure On Demand Identity or Identity as a Service (IDAS) model is deep integration. As mentioned above, Enterprise IT is looking for SaaS application to be woven into their internal infrastructure in a hybrid On Demand/On Premise architecture. Integrating an On Demand application requires user information to flow from the enterprise environment to the On Demand application and back. Because the IDAS does not explicitly provide software that runs in the enterprise – this level of seamless integration is often out of scope for an IDAS Identity broker.

Another approach to addressing the enterprise Identity challenges of On Demand applications is to deploy technology inside the firewall that makes Identity information exportable. This is the business Ping Identity is in. We provide standards based technology that gives the enterprise a portable identity capability. Many of our customers use our technology to pass identity information to Salesforce.com and GoogleApps for things like enabling single sign on – so users do not have to use a separate user name and password account for those services. Going forward the same technology and standards can be used to enable and secure deep integration to On Demand Services. In addition, this basic portable Identity capability allows an enterprise to more easily leverage On Demand Identity Services.   

Salesforce.com famously promotes their service with the slogan “No Software” – the idea being that line of business user of Salesforce.com can get all the value they need from the application through a web browser without having to engage their corporate IT department to install complicated software behind the firewall.  As Salesforce.com matures as a vendor and as their customer base expands to include large enterprise deployments,  the “No Software” religion is under pressure to move to a more flexible model where enterprise IT applications are tied directly into Salesforce.com to provide single sign on, integrate with intranet portals, and exchange application and reporting data. This hybrid model will become the norm as large enterprises shift some of their applications to the cloud, but continue to leverage past investments in internal infrastructure. It is increasingly obvious that the Identity roadmap for the cloud points toward a hybrid model as well – where large enterprises have the capability to make their user identities portable and pass Identity information back and forth with their cloud based vendors in a secure and seamless manner.

Identity and the Cloud – bullet list

• Ping Identity announced today that we have acquired the SaaS facing side of Sxip Identity, Sxip Access.  

•  This is great news for everyone working on identity related challenges in the On Demand/SaaS/Cloud computing arena.

•  Bringing together the two leading innovators in the SaaS identity space will drive the adoption of standardized identity management models in a market segment that for too long has relied on home grown, one-off, proprietary solutions.

•  This move comes at a time when SaaS adoption is skyrocketing in parallel with enterprise customer expectations for integration, security, and ease of access. 

•  With more IT shops taking an enterprise wide view (rather than a departmental view) of their SaaS usage, Ping Identity, with its full suite of identity solutions designed specifically for the SaaS model, becomes the clear market leader in delivering single sign on, provisioning and deep integration for applications hosted in the cloud.

•  SaaS leaders Salesforce.com and GoogleApps already partner with Ping Identity to help bring identity solutions to their customer base – the addition of the Sxip Access product line will further extend the value Ping Identity brings to those relationships.

• Look for an acceleration of the adoption of SAML as the foundational standard for identity solutions in the SaaS/On Demand/Cloud world.

Contrasting Views of the Internet

Thought it would be interesting to juxtapose/archive these two interpretations. On the left is Fred Wilson referencing Seth Godin and Marc Andressen on Feb 11th, 2008. On the right is Mark Cuban on Feb 10th, 2008:

   

Here's What We Have To Do   If you are thinking about building a   web service, take the advice of Seth Godin. This is from his post today on rethinking   what an auction can be.   my point is that this is just the   beginning of using internet tools to change the world we interact with, as   opposed to trying to make it easy to interact with the standard world using   the Internet   Marc Andreessen   said this about web 2.0 last year:   what we have seen over the last   several years is the Web itself coming into its own.   After an initial phase of the Web as a   medium, in which lots of people attempted to make the Web look like a newspaper, or a magazine, or a TV channel, we as an industry have recently   been collectively developing a much clearer idea of what the Web is really   like as a medium in and of itself.   This has led to broad realization of a   set of design   patterns for how Web services and Web companies often get built and used.   Which is great.   Exactly. But as Seth said, it goes   even farther. The web is changing the world we live in. And we have the tools   to change it even more. Way more. That's what we have to do.

The Internet is Officially Dead & Boring -   Its the economy stupid !     Feb 10th 2008 2:45PM   There was a lot of discussion about my previous posts   here and here.   My point is that the internet is a stable platform. Its a utility. Its   evolved to the point where you can count on it and develop applications for   it without much fear that its going to change.     What confirms my point is that with all the talk of a possible or existing   recession, not a single mention is ever made about how increases in   productivity from technology will pull us through. That is counter to the   recessions of the past 25 years. Whether it was the early 80s, the 90's or even   the post bubble , economists and others pointed to technology as a catalyst   to productivity that would help pull us out of our economic doldrums.     When there were boomtimes , as we saw from about 91 to 2000, technology was   given the lions' share of the credit.     So where are the claims of further productivity enhancements from technology   ? They are no where that I can find.     In fact, we can start to make arguments to the contrary. That technology and   in particular social network and video sites can be a hindrance to   productivity in the workplace.     Further arguments can be made that the MSFT YHOO potential merger is further   evidence that the technology industry is maturing.     It is what it is.

I agree with the Wilson/Godin/Andressen view. I think Doc Searls has said everything we use on the Internet today is an alpha/prototype - it sure feels that way sometimes. Advances in data integration, more intelligent personalization, social connections that can be assembled and dis-assembled at an instant, improved service discovery, better identity handling, etc. all will enable our lives to flow through the Internet in more efficient, more pleasing ways. You'd have to be a cashed out billionaire to call "bor-ring!" at this point.

Great Advice

I have been really digging the iTunesU content recently and one lecture by Joel Peterson at Stanford GSB in particular.

Here is a link to the iTunes download:

http://deimos3.apple.com/WebObjects/Core.woa/Browse/itunes.stanford.edu.1300557408?i=1443727288

Peterson is a longtime lecturer at GSB and has had a remarkable career in real estate and private equity.  In this lecture he covers his way of thinking about Trust in great detail - the short version is that Trust is a bedrock requirement for business negotiation and that a person is worthy of trust when they have (1) Character (2) Competence and (3) Empowerment. That is a helpful set of criteria for assessing those your deal with and yourself .

Peterson highlights the importance of Trust by pointing out that all of our dealings - both business and personal - are "serial", as opposed to "episodic".  In other words, our daily interactions are all part of a longer story - and how we behave in each of those interactions will determine the direction of the story.

Good stuff.

Fighting Phishing with Federated SSO

The success of the recent phishing attacks at Salesforce.com should trigger a fresh look at the risks of collecting authentication credentials (especially user names and passwords) on public web forms. The public web forms are the fundamental point of attack for phishers and until they are eliminated, successful phishing attacks will continue to occur and continue to cause significant business damage to companies like Salesforce.com and their customers.

The public web form used for authentication is at the center of most phishing attacks, here is a common sequence -

• a phisher creates a copy of the real web form and puts it out on the public internet
• sends a disguised link to a larger group of users
• tricks a user into providing their real credentials to the fake form
• takes the real credentials to real public web form and get access to the application

Suggested remedies like training users and studying audit logs do not address the fundamental situation that makes phishing possible.

Removing the public web form from the process of accessing applications such as Salesforce.com would greatly lower the risk of getting fished. Adopting a federated SSO model for accessing Salesforce.com would allow for the elimination of public web forms.

In the federated SSO model, all credential collection happens internally. Users are authenticated within their own employers security domains and then a secure federation assertion is passed to the external application to authenticate the user at the external application.

Salesforce.com and many other SaaS /On Demand vendors currently support SSO - they do so primarily  to meet customer requirements for convenience. The recent round of attacks should help them see that federated SSO is a very useful tool in lowering the risk of getting phished. Yes, there are some use case details to be ironed out such as support for deep linking - but the fundamental benefit of eliminating the risk associated with collecting credentials on a public web form should be enough to drive adoption of federated SSO in the SaaS/On Demand community.

Customers of SaaS applications should recognize the basic risks associated with having their employees entering user names and passwords on public web forms and demand a different model.

My guess is that in a couple of years we will look back on the practice of users inputting user names and passwords into public web forms as an arcane old style web oddity, similar to the way we now look at the blink tag.

Those days were

WACKY.

The Stuff Dreams are Made of...

In no particular order:

• Brad Fitzpatrick and David Recordon's Open Social Graph - with appropriate caveats provided by Dare

• Walpole Little Leaguer's Game Saving Catch (2 outs, bottom of the 6th, up by one run....)

When I was 12, I made that same catch 1000 times tumbling over the couch in the family room - unfortunately ESPN was not there to capture the highlights.

• Sardegna for 2 Weeks. Ci vediamo!

 

Pleased to Meet Me?

Attention Trust has popularized the idea that our online behavior (clicks, posts, comments) can be aggregated to paint an accurate picture of who we are. This idea has been picked up in the nascent Implicit Web meme that focuses on how our online footprints (click histories, etc.) can be run through algorithms to produce content recommendations and targeted content (and ads) that are tuned to align to our specific interests. The commentary surrounding Attention generally focuses on commercial applications versus privacy concerns. I'm predicting the  impact of sophisticated attention data analysis will be felt closer to home.

I've noted of some fun examples of Implicit Web technology, such as iConcertCal, in the past but the apps available today merely hint what is possible. An attention data parsing algorithm that can produce a precise identity profile could have a profound impact. If the Attention Trust formula:

How I Browse + What I Say + What I Read = Me

turns out to be true, then I may have some explaining to do - to myself.

If you asked me today, I'd say I browse, write, and read on the Internet to address some basic human concerns around career, education, networking, community, entertainment, etc. Admirable stuff. Trouble is, the computer that analyzes my attention data may come up with a different interpretation. Am I really interested in having my self-image subject to an objective analysis? Maybe I am, but it may take me a while to get to know and like the person who is revealed by my online behavior.

Japanese poet Kobayashi Issa wrote a haiku Robert Hass (former US Poet Laureate and a favorite teacher of mine at Berkeley) translates to:

Full moon;
my ramshackle hut
is what it is.

Issa came up with that sometime in the early 19th century. For the self-aware, the insights revealed by analysis of our own attention data may end up being a "full moon" that will force some  interesting re-calculations; pushing us closer to Issa-like levels of self-knowledge and, hopefully, self-acceptance.  All that and much more relevant advertising. Life in the Implicit Web will be grand, challenging in many ways, but grand.

Analog Flashback - Atari 2600

OK, not exactly an"analog" flashback under a strict definition, but with graphics like these, in relative terms, let's call it analog...

The Atari 2600 came out in 1977 at a cost of $199 - which in 2007 dollars comes to roughly $661. For comparison sake you can now buy a Nintendo Wii system for less than $400. Another example of the premium charged for high quality home entertainment in the late 70s.

 

Google News Comments

Google announced that they have implemented a moderated comment system for Google News that allows subjects of news items to add their perspective and have that view cited next to the story. The back and forth in Google News comments will be interesting, but a bit dizzying as well.

 

The 2004 book Softwar, which tells the Larry Ellison/Oracle story, employed a model where Larry was allowed to insert his personal observations as footnotes into the text. In Softwar, the narrative presented by the author, Economist editor Matthew Symonds, is often discounted or re-spun through Larry’s footnotes. This forces a higher level of engagement and attention from the reader who, in order to take meaning away from the book, must assess the veracity of Larry’s narrative in contrast to the story the author has cooked up. Larry’s footnotes and comments in Softwar provide more information, but the format requires more work on the part of the reader to parse through the different perspectives. 

The way reputation plays out in blog comments presents a similar challenge. Last week I described the story of Wellsphere and their CEO as told by Uncov and in user comments on Valleywag and Techcrunch. 5 commenters left responses to my post – which is curious since only 3 people regularly read this blog. The skirmish for control of the Wellsphere narrative in the comments section on my sparsely read blog reveals how closely Internet users monitor even the most obscure blogs for mentions of themselves or their companies and then use comments to pile on or contradict the points raised in the post.

The debate dynamics in play in comment sections are great for getting the full spectrum of opinion on a given post but they also create a real challenge for the time challenged reader who is looking to read a post and form a conclusion. With the innovation happening in the Comment Management space around products like Intense Debate and SezWho – more comprehensive visibility into comments and commenters is coming. Ideally these systems will make it easier to net out an opinion from controversial blog posts with many contradictory comments. Google News comments is sure to be a battleground for PR firms and spin masters – getting meaning from stories there will get more challenging.