Welcome!

@CloudExpo Authors: Elizabeth White, Yeshim Deniz, Liz McMillan, Pat Romanski, Zakia Bouachraoui

Related Topics: @CloudExpo, Microservices Expo, Containers Expo Blog, @DXWorldExpo, SDN Journal, FinTech Journal

@CloudExpo: Article

Three Approaches to Single Sign-On for Cloud Application Providers

Ignore, pretend or do something about it?

Did you know that:

  • Half of paid SaaS customers do not use the application at all
  • Nine out of 10 has left an application when they forgot a password, instead of restoring it
  • Eighty-six percent may leave a web site when asked to sign up
  • Two out of five would rather scrub the toilet than come up with a new password

These figures, based on research from Totango and Janrain in 2012, clearly show that sign-up and sign-on are major issues for any cloud application provider.

If you are providing cloud applications to businesses, single sign-on must at least have been up for discussion. Like with most other challenges, there are three possible approaches you can choose between:

  1. Pretend it is not your problem
  2. Pretend you are doing something about it
  3. Do something about it

Let's look at how your choice affects your business, which after all should be your guiding light.

Pretending it is not your problem
This approach is very popular to any challenge, because you get away without doing anything.

Many application providers decide to outsource management of user accounts and password to the customers. They offer some kind of web based administration interface, which one or more local administrators can use to create new user accounts and keeping old ones up-to-date.

However, this approach has some major drawbacks for your business. According to the research mentioned earlier, sign-up and sign-on are among the most critical processes for any online business. This approach transfers the responsibility for these critical processes to people you have no control over, and who have little or no incentives to support your business.

Pretending you are doing something about it
Another popular approach to any challenge is to pretend to do something about, because then you at least have your own back covered.

Some application providers choose this approach by deciding that they only support standards. The problem is that there are no widely adopted standards in this field. SAML is promoted as an industry standard, but that is of little value when your customers haven't adopted it. According to Eric Olden, one of the fathers of SAML, in an article in Computer Magazine in 2011: "The problem with federation and SSO is that, after more than a decade, SAML adoption has not risen above 10 percent of enterprise apps - apparently due to the excessive costs of infrastructure software. There simply is not enough return on investment for most service providers to implement, expand, and manage a complex federation network". The adoption among large enterprises is not any bigger, and especially among mid-sized enterprises SAML is practically non-existent. In my own personal opinion, SAML requires too much from too many to make it mainstream any time soon.

If you pretend you have a solution, then you have to pretend the benefits as well. If half of your business comes from large organizations, and if 10% of them support SAML, then this approach can only bring improvements to 5% of your business. From a business point of view, having a solution that improves 5% of your business is nice to have, but it is by no means strategic.

Doing something about it
Doing something about it is always the hardest choice, because it means that you have to go out to the customers and figure out what would work for them.

So, what are customers using today? As stated above, some large organizations have invested in SAML, but what about the rest? The least common denominator is a network, a user directory, a web server and an internet connection. The most typical setup is a Windows Domain, Active Directory and Microsoft IIS. Active Directory has a market share that is reported to be above 90%, and that figure gives a good indication for the other components as well. Such adoption rates are required by true de facto standards, which are solid enough to build strategic solutions on.

If you are serious about growing your business with large and mid-sized organizations, then it is of strategic importance to eliminate adoption and engagement obstacles related to signing up and signing on. You have to proactively convert as big a share of your customer base as possible to automated sign-on as fast as possible. In order to succeed, requirements on your customers have to be as low as possible in terms of time, investments and expertise. In practice this means that you need a solution, which does not require anything more from your customers than the least common denominator described above. From a business point of view, SAML is just a bonus, and only if you have customers who have invested in it.

If you are interested in such a solution, I would love to continue talks in person.

More Stories By Kjell Backlund

Kjell Backlund, CEO of Emillion, is a seasoned software business entrepreneur with over 20 years experience in international business. He founded Emillion in 2001, with the vision that automating sign-on and user management would be essential to the success of SaaS and Service Desk applications(www.emillion.biz).

CloudEXPO Stories
Dynatrace is an application performance management software company with products for the information technology departments and digital business owners of medium and large businesses. Building the Future of Monitoring with Artificial Intelligence Today we can collect lots and lots of performance data. We build beautiful dashboards and even have fancy query languages to access and transform the data. Still performance data is a secret language only a couple of people understand. The more business becomes digital the more stakeholders are interested in this data including how it relates to business. Some of these people have never used a monitoring tool before. They have a question on their mind like "How is my application doing" but no idea how to get a proper answer.
CloudEXPO New York 2018, colocated with DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
SYS-CON Events announced today that DatacenterDynamics has been named “Media Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY. DatacenterDynamics is a brand of DCD Group, a global B2B media and publishing company that develops products to help senior professionals in the world's most ICT dependent organizations make risk-based infrastructure and capacity decisions.
DXWordEXPO New York 2018, colocated with CloudEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
@DevOpsSummit at Cloud Expo, taking place November 12-13 in New York City, NY, is co-located with 22nd international CloudEXPO | first international DXWorldEXPO and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete at launch. DevOps may be disruptive, but it is essential.