Cloud Identity: What Happens Next?

Editor's Notes

• #5: IT departments hand rolled identity with database tables. It was easy enough – create a table with user id, first name, last name, password, and so on. If you knew what you were doing, of course, you would store a password hash, or if you were REALLY smart, a salted password hash. Users were able to log in to apps, but maintaining a home-grown solution was a lot of work, and poor practices, such as storing plaintext passwords, abounded.
• #6: Vendors saw the opportunity to create point products –amortizing the cost of producing software across many customers, making it cheaper to buy than build, and, hopefully, making a little money in the process.In 1996, Netscape released their Directory Server, which had its roots in the University of Michigan implementation of the LDAP standard. At around the same time, Netegrity created SiteMinder for single sign-on between intranet apps. A few years later, Waveset created Lighthouse for provisioning identity between enterprise systems.
• #7: Over time, the larger vendors built/acquired suites – CA boughtNetegrity, acquiring Siteminder; Sun acquired NDS via their iPlanet alliance with Netscape, and later purchased Waveset, but Sun wasin turn swallowed up by Oracle.
• #8: We can see a parallel with the evolution of business applications
• #9: IT departments hand rolled payroll, HR, CRM apps
• #10: Vendors created point products – Peoplesoft in HR, Siebel in CRM, JD Edwards in Enterprise Resource Planning, and so on – again, amortizing the cost of producing software across many customers
• #11: Over time, the larger vendors built/acquired suites if business applications – Oracle, or course, swallowed up all three of the vendors on the previous slide.SAP started in enterprise resource planning, and built out a suite encompassing customer relationship, supply chain management, and so on. Through a series of acquisitions, Microsoft have built their Dynamics suite to cover much of the same ground.
• #12: So, we can look at what happened next in business apps and see how it maps onto the identity market.
• #13: We saw the first SaaS point products – Hotmail – guess? 1996! Salesforce CRM in 2000, their initial beta customers supported by servers located in an apartment just a few blocks from here. Google launched their consumer email service, Gmail in 2004.
• #14: And, in this SaaS cycle, the vendors expanded their offerings into suites through acquisition and in-house development - Google Apps, Salesforce, Netsuite
• #16: IT depts havenever stopped writing point solutions, extending off-the-shelf apps, but how could this work in the cloud?
• #17: PaaS gave them a way to write apps to run on cloud provider infrastructure. IT depts began to extend existing SaaS apps, and build completely new apps, on Force.com, GAE, Azure, and Heroku.
• #18: But it wasn’t only IT depts that were writing apps. A whole ecosystem of ISVs writingPaaSapps has emerged, with marketplaces such as Salesforce AppExchange, Google Apps Marketplace, Windows Azure Marketplace acting as their distributionchannel. And it’s not just small utilities and addons that are selling through the PaaS marketplaces – BMC RemedyForce and Kenandy Social ERP are fully fledged business apps marketed through this new channel.
• #19: And now it is becoming a rarity to actually acquire physical media for software
• #20: So, back to identity – what’s going on?
• #21: Over the past couple of years, we’ve seen point products described as ‘Identity-as-a-Service’, products like PingOne, Okta, and Symplified, providing identity management in the cloud.
• #22: Facebook have essentially built an Identity platform in the consumer space, with Facebook LoginAt Salesforce, we’re creating Salesforce Identity as part of our wider platformWe saw the glimmerings of IdPaaS with Windows Azure Active Directory - but it's missing something!Google had an opportunity to become an enterprise identity platform, but it missed it, for the same reason: not fully supporting SAML, the standard for single sign-on between security domains.
• #23: Early in the industrial revolution, nuts and bolts were hand turned. Factories would employ fitters, whose job was to sort through the nuts and bolts to find ones that fit together. You could hand-build something like a bicycle this way, but, as the industrial revolution progressed, and nuts and bolts were created by machine tools, their thread and head dimensions were standardized, so you can take a bolt from one manufacturer and use it with a nut of the same specification from any other manufacturer, and be confident of a good fit. This standardization enabled us to to build larger and larger projects.
• #24: For the same reason, any identity platform has to be based on standards!SAML is the enterprise standard for single sign-on across security domains, with almost universal support. It’s interesting that MSFT supported SAML in version 2.0 of Active Directory Federation Services, but seem to have taken a step backward with Azure Active Directory, and are only supporting WS-Federation for SSO. Weird.OAuth 2.0, recently standardized as RFC 6749, enables applications to gain authorized access to web services.SCIM, the System for Cross-Domain Identity Management, defines a schema for representing users and groups and a REST API for manipulating them.OpenID Connect, still under construction, takes a more modern approach to cross-domain authentication.These are the standards that will allow identity platforms to scale. For example, with 100,000 customers, we at Salesforcecan’t get into the details of integrating with one off internal apps, CoTS apps that use proprietary protocols, etc. Standards are essential.
• #26: Recall business app trajectory
• #27: I believe we will see an ecosystem of innovative new identity appsBuilt on cloud platformsLeveraging standardsFilling gapsProviding innovative functionality
• #28: It’s important to remember that SaaS suites, SaaS point products, on premise suites, on premise point products, and custom apps - all still co-exist
• #29: As do the corresponding categories of identity products.
• #30: Show how identity products interlink business apps
• #31: Huge opportunity for a new ecosystem of third party apps, leveraging standards, because they have to!
• #32: "When we launched Salesforce Identity, I heard an analyst describe it as an 'extinction event' in the industry. I think we will see some dinosaurs die off, but I also think there will be a Cambrian Explosion. I say to the developers in the room: 'What are you going to build tomorrow?'".