1 00:00:00,000 --> 00:00:05,000 Hello everybody. Here we are in Sun's Santa Clara offices. 2 00:00:05,000 --> 00:00:08,000 We have two special guests with us. Would you like to introduce yourselves? 3 00:00:08,000 --> 00:00:15,000 Okay. I'm Pat Patterson. I'm a Federation Architect here at Sun Microsystems working on the OpenSSO project. 4 00:00:15,000 --> 00:00:21,000 And I'm Daniel Raskin. I'm a Senior Product Line Manager also working on OpenSSO in the market. 5 00:00:21,000 --> 00:00:28,000 The thing that we were going to talk about today is sort of what you might call some identity stuff in the SaaS world that you guys have been working on. 6 00:00:28,000 --> 00:00:34,000 So the big thing we've been noticing is we've been seeing more and more uptake on people asking about how to actually do federation, 7 00:00:34,000 --> 00:00:40,000 not only to business process outsourcers or affiliates or subsidiaries, but actually more and more SaaS applications. 8 00:00:40,000 --> 00:00:45,000 It's a growing problem that's been occurring within organizations because within the enterprise, organically, 9 00:00:45,000 --> 00:00:51,000 people are starting to use Google Calendar, Google Mail, Facebook, and they're using their work identity when doing it. 10 00:00:51,000 --> 00:00:58,000 And so more and more as this has been a growing concern, we've had to think about how to federate to those applications, 11 00:00:58,000 --> 00:01:03,000 how to actually have single sign-on from the internal applications to those SaaS applications. 12 00:01:03,000 --> 00:01:11,000 And so what we've been doing is we've been building flows to focus on helping people federate with Google Apps and Salesforce.com. 13 00:01:11,000 --> 00:01:19,000 And what we plan to do is continue down that road with any SaaS application that supports standards-based ways of doing federation, 14 00:01:19,000 --> 00:01:26,000 we're going to support it in our app as a way to make it very easy to drive those connections and essentially build federated mashups. 15 00:01:26,000 --> 00:01:31,000 So in that sort of, I guess, cross-firewall world of identity management and doing identity, 16 00:01:31,000 --> 00:01:39,000 what are some of the technical challenges people face with that, other than the obvious thing of you have a system over there and a system over here? 17 00:01:39,000 --> 00:01:46,000 Historically, the main challenge you've seen is that a lot of these integrations have been point-to-point using proprietary protocols. 18 00:01:46,000 --> 00:01:55,000 And we saw that in the past with Salesforce, that they had a proprietary mechanism to single sign-on from the enterprise to Salesforce.com. 19 00:01:55,000 --> 00:02:07,000 And over time, that gets very expensive because as an enterprise, you've got N unique proprietary mechanisms to deploy. 20 00:02:07,000 --> 00:02:18,000 And what we've seen more recently is SAML 2 being used as a standard for this so that you deploy SAML 2 to federate with Google, for instance. 21 00:02:18,000 --> 00:02:24,000 And then when you come to federate with Salesforce.com, your marginal cost is very low because you've already got the software. 22 00:02:24,000 --> 00:02:25,000 Uh, and the expertise in-house. 23 00:02:25,000 --> 00:02:32,000 Backing up a little bit, I mean, what is the, what is sort of like the identity syncing that people are doing between these? 24 00:02:32,000 --> 00:02:36,000 You've got a couple of options with, um, systems like Google and Salesforce. 25 00:02:36,000 --> 00:02:40,000 You actually have to have an identity there in their systems. 26 00:02:40,000 --> 00:02:44,000 So you've got to have some provisioning of identity. 27 00:02:44,000 --> 00:02:49,000 And, uh, perhaps most importantly, deprovisioning when employees leave the company. 28 00:02:49,000 --> 00:02:50,000 Right. 29 00:02:50,000 --> 00:02:52,000 That's always the, uh, the most important one. 30 00:02:52,000 --> 00:02:58,000 You know, IT and HR say, yeah, we want employees productive as soon as they come on board. 31 00:02:58,000 --> 00:03:00,000 But if it's a couple of days, that's not too bad. 32 00:03:00,000 --> 00:03:03,000 But as soon as an employee walks out the door, you want them out of the system. 33 00:03:03,000 --> 00:03:04,000 Right. 34 00:03:04,000 --> 00:03:07,000 I guess you also want them very unproductive once they leave the door. 35 00:03:07,000 --> 00:03:08,000 Yeah. 36 00:03:08,000 --> 00:03:09,000 That's right. 37 00:03:09,000 --> 00:03:10,000 That's true. 38 00:03:10,000 --> 00:03:16,000 The, uh, the answer to that is to build, um, provisioning adapters into products like identity manager. 39 00:03:16,000 --> 00:03:17,000 Right. 40 00:03:17,000 --> 00:03:18,000 So that's kind of out of our scope a little bit. 41 00:03:18,000 --> 00:03:26,000 Um, and then they just, it just works in exactly the same way as you create an Active Directory account when their user comes into the organisation. 42 00:03:26,000 --> 00:03:29,000 You create a Google Apps account. 43 00:03:29,000 --> 00:03:31,000 And then they can go there for their Gmail. 44 00:03:31,000 --> 00:03:35,000 Uh, and in some other systems, um, you don't even need to do that. 45 00:03:35,000 --> 00:03:43,000 In some systems we see, um, all that matters is that you are an employee of, uh, this, this enterprise. 46 00:03:43,000 --> 00:03:48,000 And in that case, um, you don't need any state at your service provider. 47 00:03:48,000 --> 00:03:52,000 You just need that, um, single sign on transaction. 48 00:03:52,000 --> 00:03:53,000 Right. 49 00:03:53,000 --> 00:03:55,000 To say, this, this person is a current employee. 50 00:03:55,000 --> 00:04:00,000 And that's, that's kind of, uh, a really great one because in that case you don't have to share credentials at all. 51 00:04:00,000 --> 00:04:06,000 So, in that case, when you think about security, it's, you know, that application doesn't need to know who that user specifically is. 52 00:04:06,000 --> 00:04:11,000 It just needs to have that circle of trust between the identity provider and the service provider. 53 00:04:11,000 --> 00:04:14,000 So, you've named, uh, Salesforce and Google and some other things. 54 00:04:14,000 --> 00:04:18,000 And what are some other SaaS services that, that people are integrating with across the firewall? 55 00:04:18,000 --> 00:04:19,000 So, we're seeing uptake. 56 00:04:19,000 --> 00:04:24,000 We focused on, um, Google and Salesforce because those are the ones that we see the most opportunity. 57 00:04:24,000 --> 00:04:33,000 And in fact, in, particularly in Europe with Google Apps, we've had some very large, um, deals where people are, are federating, you know, 20,000 employees, 30,000 employees. 58 00:04:33,000 --> 00:04:34,000 Oh, right. 59 00:04:34,000 --> 00:04:35,000 To Google Apps. 60 00:04:35,000 --> 00:04:41,000 Others that you can see popping up more and more are folks like Doppler or Twitter or Facebook. 61 00:04:41,000 --> 00:04:47,000 The problem with, uh, that we face in SaaS, I mean, going back to your original question around the, the business challenge. 62 00:04:47,000 --> 00:04:53,000 I don't think it's as much a technical challenge as much, as much as getting the SaaS applications out there that are really popular. 63 00:04:53,000 --> 00:04:58,000 And oftentimes the primary, um, service in their respective space. 64 00:04:58,000 --> 00:05:11,000 So, for example, you know, you have Facebook and, and MySpace, but beyond that, you know, there's not a tremendous amount of, um, you know, second tier, um, companies that come close to having the reach that those, those organizations have. 65 00:05:11,000 --> 00:05:12,000 Sort of a winner take all. 66 00:05:12,000 --> 00:05:13,000 Yeah. 67 00:05:13,000 --> 00:05:19,000 And so when, when they have that kind of scale, incenting them to actually move to a standards-based way of, of doing business is the biggest challenge. 68 00:05:19,000 --> 00:05:20,000 Right. 69 00:05:20,000 --> 00:05:24,000 In other words, you hear a lot of uptake into discussion about OAuth, which is still young. 70 00:05:24,000 --> 00:05:31,000 You have some popping up doing SAML authentication and others doing, you know, open ID or other ways of, of, um, connecting. 71 00:05:31,000 --> 00:05:39,000 And so there, there hasn't been a consistent way for all these different SaaS applications to do federation on and on again. 72 00:05:39,000 --> 00:05:47,000 So we, what we'd love to see is, is some kind of convergence where more and more of these services start following in the, the tales of, of Google or Salesforce. 73 00:05:47,000 --> 00:05:50,000 And, you know, SAML is a great way to connect. 74 00:05:50,000 --> 00:05:52,000 It's something people are doing to connect to that enterprises. 75 00:05:52,000 --> 00:05:53,000 Why be different? 76 00:05:53,000 --> 00:06:00,000 In, in other words, I don't care if it's a SaaS application, business process outsourcing, or, you know, partner or subsidiary. 77 00:06:00,000 --> 00:06:07,000 You know, I want to have a repeatable, scalable way to connect with them and, and for it to be simple and uniform. 78 00:06:07,000 --> 00:06:15,000 Um, and so I, I, I think we, we're not at the point where we've seen mass adoption of a consistent way for a lot of these SaaS applications to connect yet. 79 00:06:15,000 --> 00:06:18,000 There's a lot of data initiatives up and running and things like that. 80 00:06:18,000 --> 00:06:19,000 It sounds like what you're saying. 81 00:06:19,000 --> 00:06:25,000 It's, it's, one, it's a combination of, of the leaders not necessarily having the pressure to have to fix that problem. 82 00:06:25,000 --> 00:06:26,000 Yeah. 83 00:06:26,000 --> 00:06:27,000 Because of the leaders. 84 00:06:27,000 --> 00:06:30,000 But also just because of the newness, like you're saying, their betas and things like that. 85 00:06:30,000 --> 00:06:36,000 I mean, do those, are there other factors that are sort of like, why we don't have perfect identity federation or, or, or whatnot now? 86 00:06:36,000 --> 00:06:37,000 I think that's a big one. 87 00:06:37,000 --> 00:06:43,000 I think getting kind of agreement across the board on what they're going to implement is, is a difficult one. 88 00:06:43,000 --> 00:06:44,000 I don't know if you. 89 00:06:44,000 --> 00:06:53,000 Well, I think as well, um, as far as a lot of engineers are concerned, there's always a temptation to, um, build your own. 90 00:06:53,000 --> 00:06:54,000 Right. 91 00:06:54,000 --> 00:07:04,000 And, um, you know, it's, it's a fairly easy problem to understand, you know, you've got to get some, uh, single sign on across internet domains. 92 00:07:04,000 --> 00:07:14,000 And, um, you know, just about anybody could come up with something in an afternoon, but coming up with something that's scalable and secure, um, is a bit more of a challenge. 93 00:07:14,000 --> 00:07:21,000 And then coming up with something that, uh, can be adopted industry wide, well, you're really into reinventing the wheel there. 94 00:07:21,000 --> 00:07:24,000 There seems to be a whole lot of new entrance to it. 95 00:07:24,000 --> 00:07:29,000 It seems like identity was very much owned, if you will, by the enterprise identity people. 96 00:07:29,000 --> 00:07:34,000 And there wasn't much, I don't even really know how to characterize them because they're not always necessarily consumer people, 97 00:07:34,000 --> 00:07:37,000 but they're just new developers coming on and doing identity things. 98 00:07:37,000 --> 00:07:45,000 Since, since you guys obviously being at Sun have a lot of enterprise experience, how does this sort of new wave of identity stuff compare to the existing enterprise? 99 00:07:45,000 --> 00:07:48,000 Well, open ID has come along in the past few years. 100 00:07:48,000 --> 00:07:53,000 Um, an open ID came along, um, with a couple of aspects to it. 101 00:07:53,000 --> 00:07:58,000 One was to give users, um, a URL as their identifier. 102 00:07:58,000 --> 00:08:04,000 So to give them something to present, um, as their kind of universal ID. 103 00:08:04,000 --> 00:08:05,000 Great. 104 00:08:05,000 --> 00:08:09,000 And the other was as a reaction against perceived complexity in SAML 2. 105 00:08:09,000 --> 00:08:17,000 Because SAML 2 is based on XML, it's got digital signatures, and the perception was it was pretty heavy weight and hard to deal with. 106 00:08:17,000 --> 00:08:22,000 And so you've, you've got these kind of two forces that got behind open ID. 107 00:08:22,000 --> 00:08:44,000 Um, and the, the, the nice thing about the users having their own URL, a general problem in identity when you're doing a single sign-on is if you have a service provider that provides service to a whole bunch of, uh, identity providers, so identity providers where you log in, where you have your account. 108 00:08:44,000 --> 00:08:50,000 Somehow, um, you've got to figure out which identity provider a user is coming from. 109 00:08:50,000 --> 00:08:51,000 Mm. 110 00:08:51,000 --> 00:08:59,000 So if you're going to Google Apps to get your email, I've got to know somehow that you're from Redmonk, so I can hand off to Redmonk to actually log you in. 111 00:08:59,000 --> 00:09:03,000 I mean, this concept of the user having the URL kind of neatly gets over that. 112 00:09:03,000 --> 00:09:16,000 But you get into this whole, um, uh, set of trade-offs that if the user has a URL he gives to everybody, then suddenly his identity can be linked across all of those different service providers. 113 00:09:16,000 --> 00:09:18,000 And is that actually a good thing? 114 00:09:18,000 --> 00:09:19,000 We've seen that come up. 115 00:09:19,000 --> 00:09:34,000 We've seen, um, some adoption out there in Web 2.0 land, um, but it's solving a really different set of problems from the enterprise, because in the enterprise you tend to have a much more static, uh, set of partners. 116 00:09:34,000 --> 00:09:39,000 And, you know, the, um, the onus is on, uh, security. 117 00:09:39,000 --> 00:09:41,000 You know, the real emphasis is on, is on security. 118 00:09:41,000 --> 00:09:49,000 There could be no question that, um, an employee from IBM is accessing, uh, my documents out in, uh. 119 00:09:49,000 --> 00:09:50,000 Right. 120 00:09:50,000 --> 00:09:53,000 Getting to the, uh, the network we're gonna see, which we'll, we'll get to in a little bit. 121 00:09:53,000 --> 00:10:00,000 So, I mean, what we're gonna see is sort of, uh, like we were talking about, having integration between Salesforce and your local network. 122 00:10:00,000 --> 00:10:04,000 If someone else wanted to do this, aside from you guys, like, what do they get to do this? 123 00:10:04,000 --> 00:10:11,000 The first thing is just to go to opensso.org, um, hit the download button, and you can download OpenSSO. 124 00:10:11,000 --> 00:10:16,000 So, it's an open source project, uh, the binaries and source code are freely available. 125 00:10:16,000 --> 00:10:24,000 And, um, I posted some email to the mailing list, uh, a little while ago, detailing step-by-step how to federate with Google. 126 00:10:24,000 --> 00:10:30,000 So, uh, you spin up your, um, uh, OpenSSO instance. 127 00:10:30,000 --> 00:10:33,000 And you need to go to Google and buy Google apps for your domain. 128 00:10:33,000 --> 00:10:36,000 So, you know, a couple of test users at 50 bucks a piece. 129 00:10:36,000 --> 00:10:39,000 And then just, uh, follow the instructions. 130 00:10:39,000 --> 00:10:43,000 Configure a local SAML identity provider. 131 00:10:43,000 --> 00:10:48,000 And then, uh, set up your, um, signing key from there in Google. 132 00:10:48,000 --> 00:10:50,000 And then you're pretty much in business. 133 00:10:50,000 --> 00:10:56,000 It took, when we did it earlier this year, um, it took about half a day. 134 00:10:56,000 --> 00:11:02,000 And that was because I actually had to, you know, do some hammering on OpenSSO to get it to work that first time round. 135 00:11:02,000 --> 00:11:03,000 Right. 136 00:11:03,000 --> 00:11:04,000 But it's very, very quick now. 137 00:11:04,000 --> 00:11:12,000 In a future release, right now, you have to kind of create, um, a service provider for Google and, you know, type in some stuff. 138 00:11:12,000 --> 00:11:15,000 In a future release, we'll make it very much more streamlined. 139 00:11:15,000 --> 00:11:19,000 So you just have to say, okay, my domain at Google is example.com. 140 00:11:19,000 --> 00:11:21,000 And it knows the-- 141 00:11:21,000 --> 00:11:22,000 Right. 142 00:11:22,000 --> 00:11:23,000 It follows the convention. 143 00:11:23,000 --> 00:11:24,000 Yeah, exactly. 144 00:11:24,000 --> 00:11:27,000 Google has a convention for the URL that you've got to, that you've got to configure it with. 145 00:11:27,000 --> 00:11:29,000 And we can just slot that right in. 146 00:11:29,000 --> 00:11:30,000 Well, that sounds great. 147 00:11:30,000 --> 00:11:31,000 Well, we'll check out a demo. 148 00:11:31,000 --> 00:11:32,000 Okay. 149 00:11:32,000 --> 00:11:32,240 Thank you.