-----Original Message----- From: Steven_Carmody@brown.edu [mailto:Steven_Carmody@brown.edu] Sent: Friday, February 12, 2010 12:37 PM To: Thomas Hardjono; 'Brett McDowell'; community@kantarainitiative.org Subject: Re: [Kantara - Community] An observation: SSO's are consolidating and/or collaborating more
At 11:44 AM -0500 2/12/10, Thomas Hardjono wrote:
My apologies for my ignorance, but I was wondering if anyone in the industry is making any money with SSO or Web-SSO? If SSO is a facilitator towards "something", its not clear (to me) what that something is.
Service Providers are saving money, by reducing the info they are responsible for (userids, etc) and reducing the costs associated with providing that service.
As campuses (and other businesses) move to outsource more and more of their utility-like business services, Federated Identity becomes part of the equation. For instance, Brown is in the process of outsourcing check printing to a big IT company. They want to offer online access to pay stubs and W2's, rather than actually printing checks and stubs. This company asked us "have you ever heard of the Shibboleth software?". The big companies that manage retirement funds for faculty and staff offer Federated access. The list goes on -- including athletic ticketing (varying discounts based on type of campus affiliation), support for career services, parking spots, etc. And the usual assortment of services supporting instruction.
Clearly, tho, some of these services require protocols and credentials that are at the LoA 2 level.
Thanks Steve. I was driving at the seemingly historical fact that making money out of security *only* is pretty tough (unless you make your own viruses and sell the cure :) So for IdP's to succeed, perhaps SSO need to be tied to the other services that the IdP offers. Maybe is payment services, maybe cloud-based services, etc). And yes, I'm learning that Shibb and the Identity Commons(?) seem to be the largest deployment of IdPs and SSO today (though the higher-education systems/networks typically do not handle value-carrying $$$ traffic). cheers, /thomas/ hardjono[at]mit.edu