Choosing standards for cloud authentication

By Mark O Neill

July 7, 2011 — (Page 1 of 2)

CIOs naturally expect their organizations to make use of cloud applications, and often that means knitting cloud-based applications onto existing on-premise applications. The benefit is that users won’t have to enter more passwords or sign in a second time. The challenge is in choosing an authentication standard for authenticating users to the cloud services.

The Dutch computer scientist Andrew Tanenbaum said, “The nice thing about standards is that you have so many to choose from.” That describes the world of cloud authentication, except that in this case there are also some non-standards in the mix.

When choosing how to manage connections to Cloud-based services, developers have a choice between using actual approved standards (OAuth in particular, but also SAML) or de facto industry standards, which are proprietary specifications pushed by one big company (like Amazon's Query API).

OAuth and SAML are real standards. However, Amazon’s Query API is not, but it’s how you work with Amazon. Given the range of choice, developers often ask, is it wrong to not use the protocols available? From a pragmatic point of view, can you and your developers for your preferred cloud service providers implement standards across the board? This might take years, and if you wait, you risk losing the advantages of being an early mover in cloud adoption.

More heavyweight applications (as in “SOAP-based”) are typically better suited to the SAML standard, and more lightweight applications (REST-based) are better suited to the OAuth standard. In terms of maturity, SAML is a tried-and-tested standard. SAML is widely used in the mainstream and is broadly supported. For example, it is used by SalesForce.com. However, SAML does not apply comfortably to REST services and APIs.

On the other hand, OAuth, while less mature, is enjoying increasing adoption and is maturing rapidly. It is a more appropriate standard for use with REST services and APIs as it is more lightweight. Additionally, OAuth is easier to bind to lightweight REST APIs, especially with mobile applications.

Related Search Term(s): cloud

Pages 1 2

Share this link: http://sdt.bz/35707

Technorati

Digg

Slashdot

Facebook

Friendfeed

Twitter

del.icio.us

Open Cloud Initiative envisions an open cloud future Vendor lock-in is a hidden danger, so principles must be established to protect users

Electric Cloud looks to buttress private cloud development ElectricCommander 3.8 gives enterprise software developers more tools; also, a survey reveals interest in private clouds

Cloud computing is green computing Despite advances made in efficient power consumption, cloud's scalability is the best way to cut down on energy use

Comments

03/22/2012 11:51:13 AM EST

SAML has several profiles for different transfer protocol and I would say that the WebSSO profile which works very well with HTTP redirects or HTTP POSTs is one of the most frequently used ones. This WebSSO profile works perfectly with REST apps. Furthermore, comparing OAuth with SAML is like comparing apples with pears - OAuth is for service authorization, while SAML is for relaying authentication information.

LuxembourgThomas

Open Cloud Initiative envisions an open cloud future
Vendor lock-in is a hidden danger, so principles must be established to protect users Read More...