SSO comparison request from executive management

[David Langenberg]

Have you tried pointing the vendor to

http://shibboleth.net/community/consultants.html

There's many commercial entities out there who would be more than happy to sell your vendor a SLA'd support contract.

Dave

On Jan 6, 2016, at 3:19 PM, Eric Goodman <Eric.Goodman at ucop.edu<mailto:Eric.Goodman at ucop.edu>> wrote:

Way behind on this list.

I’ll throw in a related issue I’ve talked about with a few people (including Tom) on the FIWG about:

I have a vendor that installed the Shib SP to support SAML federation for a UC app. That vendor has stated that going forward they think it is too hard to support Shib, and is developing their own SP solution.

My sense is that the vendor has a mix of concern about (a) complexity of install and maintenance and (b) relying on an external entity to provide what they see as a core application capability. I’ve tried to make the argument that this is short sided and gave a number of examples (including some of the FIWG discussion and referencing saml2int, and comparing it to developing a local implementation of openssl) but don’t think I’m having much sway (and I don’t have much contractual leverage either).

In any case, I mention it here because I don’t know if there are any other vendors that have raised the concern about how much they can rely on the Shib SP for commercial support. This may be something valuable to consider in the Shib consortium or in the TIER packaging workgroups; a focus to help lower the bar (technical and otherwise) for vendors (and not just higher ed institutions) to select Shib (or other full featured SAML SP solutions) rather than custom developed ones.

--- Eric

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of IAM David Bantz
Sent: Friday, December 18, 2015 4:50 PM
To: Shib Users
Subject: Re: SSO comparison request from executive management

Thanks Tom. I will include a reference to the software recommendation (just Shibb and SimpleSAMLphp).

David

On Fri, Dec 18, 2015 at 3:20 PM, Tom Scavo <trscavo at gmail.com<mailto:trscavo at gmail.com>> wrote:
On Fri, Dec 18, 2015 at 6:24 PM, IAM David Bantz <dabantz at alaska.edu<mailto:dabantz at alaska.edu>> wrote:
> As I feared, vendor messages maligning Shibboleth as an outdated solution
> that is a nightmare to manage have triggered the following request from my
> executive management:
>
>> David,
>> I continue to get messages (primarily from Ping) about options to Shib.
>> Do you have time to do a quick comparison (functionality and cost) of Shib,
>> Ping and other vendors that should be on our radar for UA?
>
> I've replied briefly indicating why I regard the statements about Shibboleth
> as false, but I'm pleading again for a strong well-grounded response to this
> request.

The InCommon Federation Interoperability Working Group [1] chaired by
Walter Hoehn from the University of Memphis, is in the final stages of
preparing a SAML V2.0 Implementation Profile for Federation
Interoperability (linked on the WG home page). I imagine you could use
this document to compare the functionality of Shibboleth and
PingFederate, but total cost of ownership is another matter, I'm not
sure how to measure that in each case.

There is also the SAML Software Guidelines [2] published by InCommon.
In order for PingFederate (or any implementation) to be mentioned on
that page, it would have to correctly consume InCommon metadata. Apart
from the implementations already mentioned on that page, I don't know
of any software that does that.

Hope this helps,

Tom

[1] https://spaces.internet2.edu/x/ioRRBQ
[2] https://spaces.internet2.edu/x/R4HPAg
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>


--
David Langenberg
Identity & Access Management Architect
The University of Chicago

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160106/ddc11c3e/attachment.html>