Ping Identity Blog

3%

Fri, 19 Dec 2008 08:26:48 -0700

In our Ping board meeting yesterday, we reviewed the accomplishments of various departments over the last year. Engineering reported a staggering statistic. Out of 100 releases in the past 3 years, they've only slipped 3 times. The longest slip was 1 week. Next stop, 2%.

Federating the Windows Login via SAML

Fri, 19 Dec 2008 08:22:30 -0700

We just released a new version (2.2) of our PingFederate IWA Integration Kit. This integration kit allows people to SAML enable their Active Directory authentication. Giving users Internet single sign-on to partners and SaaS providers from their Windows authentication. The new integration kit is available for immediate download from the Ping Identity website.

New features:

Added ability to specify Kerberos only for IWA authentication

Allowed the Domain Controller to be optionally specified rather than resolved through DNS

Added support for JDK 1.6

Bug Fix – Adapter supports NTLM in a PingFederate cluster fronted with a load balancer using keep-alive connections

SAML for IIS Applications

Sat, 6 Dec 2008 09:34:24 -0700

The PingFederate integration kit for IIS v2.0 is now available for download from the Ping Identity Website. This upgraded integration kit allows you to enable SAML & WS-Federation single signon to and from IIS applications via PingFederate, the most widely deployed federation server on the planet!

New Features

Ported the IIS Agent to use the OpenToken Adapter and the OpenToken .NET library

Supports the POST Transport Method from the OpenToken Adapter

Added URL filtering for protected resources

Added support to allow IIS Web applications to download files

Top 10 things IT does in tough times**

Tue, 2 Dec 2008 17:13:23 -0700

1. Look at open-source alternatives.

2. Figure out how to consolidate vendors at a lower unit cost.

3. Replace manual effort with automation that can be achieved with a 3m payback.

4. Invest in new technologies that will lower cost by an order of magnitude.

5. Break down myths that an application can't be hosted externally.

6. Challenge costly, incumbent technologies with new upstarts.

7. Look for short-term projects that can delivery value quickly.

8. Attempt to put new products on existing IT infrastructure.

9. Not start any long-term, strategic projects.

10. Hit up your local sales rep for freebies (e.g. tickets to the Lakers)

** Contributed from one of Ping's advisors

SAML Single Sign-On for Salesforce

Tue, 2 Dec 2008 14:29:31 -0700

Join us and Sr. Product Manager of Security Peter Dapkus of Salesforce as we detail what's required to automate user provisioning, de-provisioning and single sign-on to Salesforce. See how Ping can help you deploy a solution in days that is either on-demand or on-premise.

SAML Integration Kit for Apache Apps

Mon, 1 Dec 2008 17:06:34 -0700

The Apache Integration Kit v2.0 for Apache 2.0 is now available for download from the Ping Identity Website.

New Features:

• Simplified Apache module by removing deprecated functionality not specific to PingFederate
• Added ability to expose attributes as HTTP request headers
• SAML subject is logged in the Apache access_log
• Updated the OpenToken library to support password obfuscation
• Updated the OpenToken library to support the POST Transport Method
• (Bug fix) Cancel URLs no longer need to be contained in a protected resource
• (Bug fix) Cookie domain is no longer validated against the agent-config file if query or POST is used as the initial transport method.

1 in 10,000

Mon, 1 Dec 2008 13:30:38 -0700

While you would never know it by the below picture, there were around 10,000 people at the Salesforce keynote a few weeks back. How they ended up with my picture is beyond me. It's a crazy coincidence given we're sponsoring some of the city tours this email was sent to promote. Too bad the picture didn't extend a bit lower so you could see the Ping logo!

The Golden Guardian

Mon, 17 Nov 2008 17:10:32 -0700

We have a lot of fun here at Ping Identity. To be sure, we love our work, and we love our industry. From time to time, we like to mix things up. Keep things interesting. Sometimes we do things formally, sometimes informally. A while back we spoke about playing around with an identity super-hero. Turns out, we never did do anything formal in Ping, but while talking about it with one of my friends, he sort of ran with it. The result of his work (Bill Turner), and his friend, the artist (Ellory) is below. Considering Bill is a Realtor by day, and Ellory is a student, I'm impressed. Wow. Introducing the Golden Guardian.

Unsolicited Kudo's

Wed, 12 Nov 2008 20:14:37 -0700

Quite frankly, I'm blown away by some of the compliments we receive from customers. I consider myself fortunate to a part of an organization that is deserving of such kudo's. I woke up to the following email this morning. This is the way to start a day.

It's always difficult to prioritize taking the time to say thanks, but on the way to work this morning I was thinking about things that are reliable in our computing environment, and your product is definitely one of the them. Thank you for that.
Ironically, when things are reliable, there is naturally less need to talk with eachother, so I just wanted to take a moment to let you, and your whole team, know that we appreciate the engineering and user interface excellence of your products. With efficiency changes pressuring IT solutions, the "set it and forget it" attributes of your services become all the more appreciated, especially by those that directly play in the middleware forests.

All the best, -- Fortune 1000 Company

SAML Integration Kits for Java, .NET and PHP

Sun, 9 Nov 2008 17:41:52 -0700

Java Integration Kit 2.3 – November 2008

• Added POST Transport Method for OpenToken when used by an SP
• Added configuration option to specify session vs. persistent cookie
• Added option to set the Secure attribute on an OpenToken when a cookie is used
• Added ability to bypass password obfuscation and strength enforcement for backward compatibility with previous Java OpenToken agents
• Correctly handles null parameters for single logout via the back-channel (SOAP)
• Empty query string (?) is not automatically appended to the URL when redirecting to the Target Resource
• Target Resource URL is URL-encoded

.NET Integration Kit 2.3 – November 2008
• Added POST Transport Method for OpenToken when used by a Service Provider
• Added configuration to specify session cookie vs. persistent cookie
• Added option to set the “Secure” attribute on an OpenToken when cookie is used
• Added ability to bypass password obfuscation and strength enforcement for backward compatibility with previous .NET OpenToken agents
• Correctly handles null parameters for SOAP SLO
• Empty query string (?) is not automatically appended to the URL when redirecting to TargetResource
• TargetResource URL is URL encoded
• Corrected not-before tolerance processing

PHP Integration Kit 2.3 – November 2008
• Added POST Transport Method for OpenToken when used by a Service Provider
• Added configuration to specify session cookie vs. persistent cookie
• Added option to set the “Secure” attribute on an OpenToken when cookie is used
• Correctly handles null parameters for SOAP SLO
• Empty query string (?) is not automatically appended to the URL when redirecting to TargetResource
• TargetResource URL is URL encoded

On-Demand Single SignOn for Salesforce & Google

Tue, 4 Nov 2008 07:33:51 -0700

Denver, Colo. – Nov. 4, 2008 – Ping Identity® today announced PingConnect™, an on-demand Internet SSO service for SaaS (software as a service) applications. Now available from Ping Identity, and on the Force.com AppExchange, PingConnect increases user adoption, reduces administration and strengthens security.

Ping Connect is initially available for Salesforce CRM and Google Apps™. It leverages Ping Identity’s award-winning PingFederate® Internet SSO software and PingEnable, the company’s expert support, services and methodologies, to deliver an on-demand Internet SSO service. PingConnect makes anytime, anywhere access to Salesforce CRM and Google Apps easier, automates user set up and removal and protects valuable data.

HOW IT WORKS

“Through years of working with hundreds of SaaS vendors, business process outsourcers, and their customers, we’ve clearly seen that PingFederate improves user adoption and streamlines administrative tasks,” said Ping Identity CEO Andre Durand. “With PingConnect we’re adding the advantages of an on-demand service to provide the benefits of Internet SSO to Salesforce and Google Apps users.”

More companies are moving to SaaS applications for inherent benefits like rapid deployment of new capabilities and easier configuration for administrators. In the May 21, 2008, report “On-Demand SFA Can’t Guarantee Success,” Gartner Vice President and Distinguished Analyst Robert Desisto said, “SaaS alone does not guarantee improved user adoption by salespeople…Salespeople want an SFA solution that's easy to use, provides information that will give them advantage selling, has collaboration tools that enable them to work with other team members, and reduces administrative burdens.”

Because PingConnect works with existing user directories and authentication mechanisms, there is no compromise to security and no administrative time wasted in setting up external SaaS directories or manually provisioning users. PingConnect supports all access methods to Salesforce CRM including desktop and mobile browsers, Connect for Microsoft Outlook and emailed report URLs.

To learn more about PingConnect visit www.pingidentity.com.

SaaS Vendors Select PingFederate for SSO

Wed, 29 Oct 2008 08:51:17 -0600

Over 130 SaaS and BPO's have now selected PingFederate to provide single sign-on for their customers. Two SaaS vendors, Truist and RazorGator have made their own announcements recently.

Truist
PingFederate® is an obvious choice because it offers broad support for the latest open standards and commercial implementations of Single Sign-On, as well as ease of management," said Neal Griffin, Executive Vice President, Technology at Truist. "We are now positioned to rapidly integrate with all of the popular SSO providers and standards used by our clients. We implemented our second client on the platform in a single afternoon."

RazorGator
“Because Ping Identity’s technology is easy to implement, and works seamlessly with existing identity management environments, we recommend PingFederate® to all customers who want single sign-on into TicketOS,” said John Wallace, TicketOS General Manager. “PingFederate allows our corporate customers to easily access their ticket management software application in a reliable and simple manner. And Ping Identity provides fantastic support.”

Ping Customers Double Since December

Wed, 22 Oct 2008 09:48:33 -0600

PING IDENTITY CUSTOMERS – 250 STRONG AND GROWING

Larger Numbers of Enterprises and SaaS Vendors Worldwide Choose PingFederate as the Proven Independent Choice for Internet SSO

Denver, Colo. – Oct. 21, 2008 – Ping Identity® today announced it has passed the 250 milestone for global customers using PingFederate for secure Internet single sign-on. Ping Identity’s customer base – now at 265 – includes 30-percent of the Fortune 100 and more than 130 SaaS and BPO providers.

Ping Identity SaaS partner RazorGator views PingFederate as a strategic business tool, providing single sign-on to its TicketOS corporate customers.

“Ping Identity’s technology is outstanding,” said John Wallace, general manager of RazorGator’s TicketOS. “Ping Identity allows our corporate customers to easily access their ticket management software application in a reliable and simple manner.”

Ping Identity’s growth has continued to accelerate as more companies implement on-demand business applications for cost savings, improved business flexibility, greater velocity and focus. The selection of Ping Identity demonstrates that companies value speed and simplicity, and understand the business value of secure Internet single sign-on.

“Securing external applications is becoming a much higher priority in today’s identity management initiatives, said Ping Identity CEO Andre Durand. “Unlike the last decade where we often saw overly complex provisioning, identity management and Web access management projects end in failure, many companies are rethinking their strategy, opting instead to focus on Internet single sign-on deployments that achieve success quickly.”

With SAML-based single sign-on connections to more than 220 customers, Rearden Commerce, the creator of the first Web-based personal assistant and leading choice among companies for managed spending, leverages PingFederate to ensure its customers’ success in gaining user adoption of the tool.

“After just one month of using PingFederate for Internet single-on, one of our customers achieved an 81-percent user adoption of its online air booking tools,” said Chuck Mortimer, director of platform services for Rearden Commerce. “Much of that success is attributed to our secure, standards-based capabilities, allowing seamless access and a smooth transition to our end users.” Ping Federate provides safe access to Internet applications without the need for repeat logins. Unlike other identity federation solutions that can take months to deploy, PingFederate is easy-to-implement and can be deployed in only a few days. The latest release, PingFederate 5.2, includes automated provisioning and advanced user access methods to support comprehensive SSO for Salesforce and Google Apps™.

About Ping Identity Corporation

Ping Identity is the market leader in federated identity management, delivering secure Internet single sign-on software and services to more than 250 enterprise customers, government agencies and service providers worldwide. PingFederate provides secure access to Internet applications through a single login. With PingFederate and PingEnable — Ping Identity’s expert support, services, and methodologies — external connections can be operational in less than a week. For more information visit www.pingidentity.com.

###

Ping Identity, PingFederate, PingEnable, the Ping Identity logo, SignOn.com, Auto-Connect and Single Sign-On Summit are registered trademarks, trademarks or servicemarks of Ping Identity Corporation. All other product and service names mentioned are the trademarks of their respective companies.

Spooky Ping

Fri, 17 Oct 2008 21:52:58 -0600

We had a great spook day at Ping this afternoon with our children. The children really enjoyed the face painter, as did a few of the adults.

Worried about Orphaned Accounts, Cost Cutting or M&A Integration?

Fri, 10 Oct 2008 14:16:41 -0600

Federation to the Rescue!

I received a great email from John Haggard today, former co-founder of Vasco, and a 20 year veteran of the SSO industry. [Disclosure: John is a Ping Identity adviser]. His experience was too good to not share.

I lived through the 80's as a vendor when things got very tough. The security market grew, not diminished. When hard times hit, and companies are downsized, there are a lot of disgruntled employees, and that's a security risk, especially if automation of de-provisioning isn't in place. I think that will hold true this time as well. When companies go into survival mode, the one thing they are not worried about is anything having to do with "improving." Companies have a completely different mindset and things become a whole different playing field.
In the case of Ping, layoffs in organizations will trigger the de-provisioning issues. The FI consolidations will really hit the issues facing consumers - gluing/mapping together existing accounts. What really hit home for SKK was ACF2 required 1 admin per 800 users. RACF from IBM was 1 admin per 100 users (independently verified). When hiring freezes hit along with layoffs, the remaining security folks become frantic for administrative elimination.
What really concerns me this time around is the huge amount of numbers of accounts that are left vulnerable as everyone is in general panic. In the 80's, a small single digit percentage of all employee's had electronic identities. Now I'm sure the number is well over 100% if you count the duplicate accounts per person. And this doesn't even account for the exponential factor that shows up in "federated" systems (partners, consumers, etc.). Accountability will be the catch phrase so anything that supports accountability (single auth event and auditing the SSO steps) will be bankable. -- John Haggard