Featured Author - Laura Taylor
With the proliferation of web-based technologies, single sign-on has emerged
as an important and central architecture solution for enterprise applications.
As security breaches become increasingly more frequent, minimizing user
access to back-end systems and web applications without impacting legitimate
usage is more important than ever before. As more web-based applications
are deployed, enterprise single sign-on (SSO) solutions that have the
capabilities to provide authentication, management, access control, and
logging across the complete front- and back-end e-business chain will
become increasingly more important to Information Technology (IT) decision
makers. Relevant Technologies has reviewed three leading portal single
sign-on products to see which comes out on top.
every viable business, non-profit or public sector organization today
has a web site connected via the Internet that links them with customers,
prospects, constituents, employees, partners and other groups. Some online
only businesses would not exist without the web and the Internet.
in web-related technologies have spawned portals, which act as gateways
to individual web sites. No matter what you're looking for, the portal
will try to give it to you. In that sense, portals go way beyond intranets
and extranets because of their community appeal and structure. Some portals
share a common content or theme, such as e-marketplaces, while others
try to be all things to all people (news, weather, entertainment, finance,
etc.). Typically most portals offer either a business-to-business (B2B)
or business-to-consumer (B2C) focus.
provide access to large amounts of information within their own managed
servers but, importantly, also provide access to other sites beyond their
own direct control. Accessing portal information has created new security
challenges, and responding to these challenges is the impetus for this
report. Specifically, Relevant Technologies has researched to what extent
Netegrity, Securant and Evidian succeed in providing a high level of access
control without making the experience too burdensome for end users. The
challenge is how to mask the complexity of authentication, authorization
and administration (3As) to users while empowering portal administrators
to provide end-user single sign-on (SSO) access to pages not only within
the portal but to external sites selected by the users themselves. Portals
who respond to this balancing act efficiently retain tight security controls
and still provide real value and convenience. By improving the user experience,
web site stickiness is created -- the process by which user loyalty is
created and future return visits to the portal are increased.
and Market Genesis
Initially, web security products protected only URLs, creating passwords
to be passed via Secure Sockets Layer (SSL), an encryption protocol built
for web browsers. In the beginning, during the Web's earliest stages,
this was sufficient, since a large array of web-enabled enterprise applications
did not exist. With the momentum of the web, web-enabled applications
have become ubiquitous, and today, are the norm. Each application typically
requires its own authorization process, and if numerous applications are
built into your portal point-of-presence, numerous authentication processes
are required. Without a single sign-on solution, a user may have to identify
themselves through a password logon scenario as many as half a dozen times
on one web site. Single sign-on creates an improved user experience, allowing
a user to authenticate themselves once on a web site, and continue to
use as many applications on that site that are available for their usage.
properly implemented single sign-on solution will write the front-end
authentication through to a central SSO management console on the back-end,
and is able to share this authentication for the extent of the user session.
By improving the user authentication experience without compromising security,
web-sites can retain user stickiness, and expect an increase in return
visitors, page views, and hits.
an added benefit, some single sign-on solutions obscure the links and
information that users are not allowed to access, and by doing so, reduce
the risk of unauthorized access, since unauthorized users and hackers
are not able to see what they are not allowed to access, at least through
the website's front-end. This process of hiding the true location of pages
and network resources access is known as URL Mapping. It should be noted
though that URL mapping makes no distinction between authorized or unauthorized
access, so the initial authentication and authorization process is again
of paramount importance.
with partner websites, and supply chain management (SCM) vendors, can
more easily be obtained through single sign-on, since it allows the host
web-site to create authentication access policies that are transparent
and unique user groups as well as individual users.
decision makers should expect to pay no more than $20 per user (in volume)
for a single sign-on implementation. Price above $20 per user is not price
competitive and signifies an engineering and development process that
has lacked adequate control over operational expenses.
Portal single sign-on has three key areas that are important for full
integration and interoperability into an enterprise environment:
verifies that users are in fact who they claim to be, and strong authentication
also provides non-repudiation. Non-repudiation is the ability to prevent
a user from refuting their self-identity or transaction.
also known as access control, is based on user roles or privileges,
and allows administrators to specify which users can access which applications,
data, or functions. Administration consists of the tools and centralized
management system that exists in order to administer and distribute
(if necessary) user data and the security policy.
also includes logging and auditing capabilities that provide time-tracked
archived records of who did what during their session.
and authorization are of critical importance, as they affect performance
and end user satisfaction. Administration capabilities are secondary,
since they affect only one centralized position.
mechanism is central to the success of a single sign-on product. All enterprise
single sign-on products should adhere to industry standards, and support
of the Lightweight Directory Access Protocol (LDAP) is paramount to gaining
wide acceptance on the market. LDAP is an alternative to the X.500 Directory
Access Protocol (DAP) and defines standards for user schema, authentication
schema, strings, search queries, and URLs. LDAP has become such a key
component in today's and tomorrow's IT structures that any portal security
product that is not fully LDAP-compliant will rapidly be relegated to
schema requires that objects have a Common Name, an Organizational Unit,
and a Domain Component. Windows 2000 and its Active Directory services
are LDAP compliant, and in order for seamless integration into a Windows
2000 environment, single sign-on products designed for enterprise deployment
must be LDAP enabled.
single sign-on solutions must be flexible and have the ability to register
and revoke sharing credentials across disparate user populations, and
new and legacy applications. Advanced single sign-on solutions can interoperate
with two-factor authentication mechanisms, such as biometrics and time-based
1. Product Information
PortalXpert, Netegrity SiteMinder, Securant ClearTrust
security, web security, authentication, passwords
security, online access, web usage
access control, management, logging
SiteMinder, Securant's ClearTrust, and Evidian's PortalXpert are the single
sign-on product leaders for securing extranet- and intranet-based web
applications. Significant competitors to the market leaders include Entegrity's
AssureAccess, Entrust's GetAccess, and Oblix' NetPoint products.
portal single sign-on products must be LDAP compliant, easy to deploy,
price competitive, and be server based. Products that eliminate the use
of cookies are more secure, and offer a greater user experience than cookie-based
One of the challenges in implementing single sign-on portal security is
adherence to the LDAP standards. LDAP has numerous extensions, and many
vendors implement only parts of LDAP, often just enough to justify calling
their product "LDAP compliant." A weak LDAP implementation will create
scalability and performance issues, and as a company's web environment
becomes more sophisticated, without strong LDAP support, it may not be
able to take advantage of the various capabilities that LDAP allows.
Public Key Infrastructure (PKI) solutions are being marketed as alternatives
to single sign-on solutions. PKI offers equally strong authentication
capabilities, and may mitigate the risk of security exposures to an even
greater degree than single sign-on solutions. However, PKI solutions are
more difficult to deploy, and the general IT public has not accepted PKI
solutions as much as the market originally anticipated.
and VPNs offer important security protections, but they have not been
optimized for customer, partner, and reseller utilization on the extranet.
Firewall protection and authentication services are geared towards employee
usage scenarios and, in order to create comparable extranet user sign-on
privileges, require individual set-up by the firewall administrator for
each user or user group. As important as firewalls and VPNs are, however,
they do not address SSO and 3A capabilities, so cannot be considered as
user-friendly portal security solutions by themselves.
Netegrity, Securant, and Evidian all offer single sign-on solutions that
are LDAP compliant. In this regard, they are all equal contenders, and
this is one of the reasons that these three products are considered the
Netegrity and Securant offer solutions that work, they are agent-based
products that require additional software on all web servers plus cookies
on end user desktops. Added resources required by these solutions clearly
increases the time-to-deploy and overall price of the entire implementation,
and requires that on-going administration be done on all target systems
and user devices. Additional work on the part of the administrator, and
potential interruption to the user for agent deployment, demonstrates
that these products are not seamless, and their cost of ownership goes
far beyond the initial licensing fees. The time it takes to deploy SiteMinder
and ClearTrust are both equally a factor of how many servers will be supported
by the single sign-on technology. Systems administrators can expect to
spend two hours per server supported. On a web farm of 10 servers, implementations
of SiteMinder and ClearTrust would take 20 hours each compared to a 2
hour implemenation time with PortalXpert. Vendors looking to take their
portal SSO products to the next level need to understand how to migrate
their products to a central administrative console that does not require
server- or client-side intervention.
password processes. In order to mitigate the security risks associated
with cookies, both vendors should work towards eliminating the need for
cookies. Due to security holes in both Netscape and Microsoft web-browsers,
cookies can inadvertently be emailed out without using HTML email, without
a user's knowledge. Since cookies often hold password and user information,
this represents a potential security exposure. By using cookies for authentication,
a malicious hacker can capture the entire user session using Java applets
or protocol analyzers. Evidian's product requires no additional software
on web servers and target systems. In addition, it does not require the
turned off will not be affected.
are some vendors, such as BMC and Symantec, that offer single sign-on
like capabilities but, in actuality, what they are offering is password
synchronization services to enterprise applications. In order to take
advantage of Control-SA from BMC and PassGo from Symantec, password synchronizations
must be distributed to all target enterprise application servers to replicate
identical credentials across the enterprise. These solutions are not optimal,
since they require more extensive resources and require secure distribution
channels across wide-area networks. Password synchronization is not the
same as single sign-on, and these solutions cannot provide URL mapping
or a unique user welcome page.
PortalXpert, Securant's ClearTrust, and Netegrity's SiteMinder all work
through a combination of rules and role-based configurations. Using a
rules-based approach is considered more scalable and flexible than using
roles because rules can be applied to not just people, but to networks,
domains, and IP addresses. Using roles implies a list-based practice,
and when a user's role changes, say, moving to another department, it
requires file edits and administrative changes. If setup properly, using
a rules-based approach typically takes less administrative resources than
using a roles-based approach. To be a market leader today, a single sign-on
portal product needs to support both rules and roles. The fact that all
these vendors support both rules and roles is one of the reasons that
PortalXpert, ClearTrust, and SiteMinder are all leading the single sign-on
PortalXpert is a newer product than SiteMinder or ClearTrust, and has
not yet proven itself on the market. There is always a risk in the implementation
of a new product. Evidian has already shown sufficient technical aptitude
with its other security management products, indicating that its success
in the secure portal management market is likely to follow suit. For example,
its AccessMaster enterprise security management software has garnered
"Best Access Control" product honors from SC Magazine for the last two
any enterprise product, scalability is an on-going concern. According
to the vendors, Evidian's PortalXpert and Netegrity's SiteMinder can accommodate
up to 100,000 users, while Securant's ClearTrust can accommodate up to
1,000,000 users. However, since vendors don't use the same standard to
define scalability, it is unclear if this refers to simultaneously connected
users or just the number that can be accommodated by the LDAP directory.
The vendors do not indicate how many servers are necessary to support
the number of maximum users, and statistics on what that means to application
performance is difficult to quantify. For example, 10,000 users might
be able to be accommodated with "instant" response, 40,000 users might
be able to be accommodated with a 3-4 second response time, and 100,000
users might be able to be accommodated with a 4-6 second response time.
Given that Netegrity and Securant have a longer track record with their
products than Evidian has, it is not clear that Evidian's PortalXpert
can scale to the same magnitude that Netegrity's SiteMinder or Securant's
As the first company to come out with a proxy based enterprise-class single
sign-on solution that does not require additional server or client-side
software or cookies, Evidian is the most visionary of the three market
leaders. Because all administrative capabilities are done on a central
management console and not on the application servers, Relevant Technologies
recommends PortalXpert as the choice for IT decision makers looking to
minimize total cost of ownership and administrative overhead. Due to the
elimination of server-side software, judicious IT managers deploying PortalXpert
can expect to reduce their implementation time for new single sign-on
applications by 80% over the other leading agent-based products.
brings more than 10 years of information technology capabilities and base
of more than 600 customers worldwide. The company is particularly strong
in security-intensive industries, such as banking/finance and government
organizations. It also is well positioned in the global telecom and service
provider industries, which has rapidly expanding needs for web as well
as legacy security solutions. With revenues of nearly $50million and an
employee resource base of about 375, Evidian will be around for the long-haul,
and we expect them to continue to anticipate new market requirements as
online transactions become even more sophisticated.
supply chain management (SCM) and customer relationship management (CRM)
applications becoming ever more prevalent, the single sign-on solution
market will continue to grow and become a necessary requirement for any
vendor putting in place an enterprise capable SCM or customer relationship
management CRM implementation.
$15 per user in volume, Evidian's product is more cost competitive than
Netegrity's or Securant's, which both sell for $20 per user. With a 1,000-user
implementation, IT decision makers can save $5,000 by selecting Evidian's
PortalXpert over Netegrity SiteMinder or Securant ClearTrust.
Taylor is the Founder and Chief Technology Officer of Relevant Technologies.
Formerly, she was the the Director of Security Research at TEC. Prior
to TEC she served as Director of Information Security of Navisite, and
CIO of Schafer Corporation.
can be reached at firstname.lastname@example.org.