SSO comparison request from executive management

[Mark K. Miller]

On Wed, 6 Jan 2016, Eric Goodman wrote:

> Way behind on this list.

Most of us are!  ;-)  Except, Scott.  I don't know how he does it; and, it 
seems pertinent to the topic of your message that I'll offer him a hearty 
Happy New Year, and a very appreciative thank you for all his effort!

Yes, we all know Scott doesn't do it alone, and I thank the rest of the 
community too!

> I'll throw in a related issue I?ve talked about with a few people 
> (including Tom) on the FIWG about:
>
>
> I have a vendor that installed the Shib SP to support SAML federation for a
> UC app. That vendor has stated that going forward they think it is too hard
> to support Shib, and is developing their own SP solution.

So, to paraphrase, 'the shib SP is to hard to use, the vendor will solve 
this by writting their own SP implementation.'

Wow, I'm just speechless about the 'logic' of that approach!!!

It has long been my personal opinion that any vendor who currently is 
spending effort writting a SAML SP implementation should just stop it!  In 
my experience, that effort has _*NEVER*_ resulted in a fully featured, 
quality SP implementation.  Any effort expended toward creating a sub-par 
implementation is, in my view, a waste, since I know of a very high 
quality, fully featured implementation already existing.

Just my opinion, and again, thank you Scott and everyone in the community 
that has allowed me to develop this opinion.

Max

> My sense is that the vendor has a mix of concern about (a) complexity of
> install and maintenance and (b) relying on an external entity to provide
> what they see as a core application capability. I?ve tried to make the
> argument that this is short sided and gave a number of examples (including
> some of the FIWG discussion and referencing saml2int, and comparing it to
> developing a local implementation of openssl) but don?t think I?m having much
> sway (and I don?t have much contractual leverage either).
>
> 
> 
> In any case, I mention it here because I don?t know if there are any other
> vendors that have raised the concern about how much they can rely on the
> Shib SP for commercial support. This may be something valuable to consider
> in the Shib consortium or in the TIER packaging workgroups; a focus to help
> lower the bar (technical and otherwise) for vendors (and not just higher ed
> institutions) to select Shib (or other full featured SAML SP solutions)
> rather than custom developed ones.
>
> 
> 
> --- Eric
>
> 
> 
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of IAM David
> Bantz
> Sent: Friday, December 18, 2015 4:50 PM
> To: Shib Users
> Subject: Re: SSO comparison request from executive management
>
> 
> 
> Thanks Tom. I will include a reference to the software recommendation (just
> Shibb and SimpleSAMLphp).
>
> 
> 
> David
>
> 
> 
> On Fri, Dec 18, 2015 at 3:20 PM, Tom Scavo <trscavo at gmail.com> wrote:
> 
> On Fri, Dec 18, 2015 at 6:24 PM, IAM David Bantz <dabantz at alaska.edu> wrote:
> > As I feared, vendor messages maligning Shibboleth as an outdated solution
> > that is a nightmare to manage have triggered the following request from my
> > executive management:
> >
> >> David,
> >> I continue to get messages (primarily from Ping) about options to Shib.
> >> Do you have time to do a quick comparison (functionality and cost) of
> Shib,
> >> Ping and other vendors that should be on our radar for UA?
> >
> > I've replied briefly indicating why I regard the statements about
> Shibboleth
> > as false, but I'm pleading again for a strong well-grounded response to
> this
> > request.
> 
> The InCommon Federation Interoperability Working Group [1] chaired by
> Walter Hoehn from the University of Memphis, is in the final stages of
> preparing a SAML V2.0 Implementation Profile for Federation
> Interoperability (linked on the WG home page). I imagine you could use
> this document to compare the functionality of Shibboleth and
> PingFederate, but total cost of ownership is another matter, I'm not
> sure how to measure that in each case.
> 
> There is also the SAML Software Guidelines [2] published by InCommon.
> In order for PingFederate (or any implementation) to be mentioned on
> that page, it would have to correctly consume InCommon metadata. Apart
> from the implementations already mentioned on that page, I don't know
> of any software that does that.
> 
> Hope this helps,
> 
> Tom
> 
> [1] https://spaces.internet2.edu/x/ioRRBQ
> [2] https://spaces.internet2.edu/x/R4HPAg
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
> 
> 
> 
>