While using cloud-based applications solves some problems for IT administrators, it also creates new ones, including how to handle user identity management.
Startup Okta, led by the former head of Salesforce.com’s engineering group, says it has the solution. For six months it has been quietly offering a hosted identity management service for companies to manage their cloud services, and it is now formally launching the company.
Two early customers include Pandora and Enterasys. Pandora runs almost 30 cloud applications, and users were continually forgetting passwords or URLs and turning to IT for support, said Todd McKinnon, CEO of Okta.
Enterasys has more than 1,000 employees using around 20 software-as-a-service apps. Before Salesforce.com referred it to Okta, Enterasys did some internal custom development to try to connect the hosted services to Windows Active Directory as a way to make it easier for users to access the services.
“It was maybe a bit unstable at times,” admitted Ben Doyle, director of IT applications for Enterasys.
Plus, the system needed frequent maintenance to keep up with updates from the hosted services, McKinnon said.
Okta is now serving both Pandora and Enterasys as well as others with its hosted offering that integrates all the SaaS services a company uses with Active Directory. Employees visit a home page that looks like an internally branded site and sign in using their existing Windows password. From there, they can access any of the hosted services.
The service offers IT administrators user management tools as well as information about use of the services. From the administrator console, an IT manager can give individual employees rights to access hosted services. Currently, administrators can choose from around 200 SaaS applications that are integrated into Okta. McKinnon said Okta plans to constantly add new applications.
Enterasys has asked Okta to add support for applications and Okta has been able to turn around and provide it quickly, Doyle said. Usually Okta has had the integration available for testing within a couple of days with full production availability in a week or two, he said.
IT managers can also use Okta to easily delete user permissions when employees leave the company or change jobs. That capability was of major interest to Doyle. While his IT department manages most of the cloud services employees use, a couple are administered by different departments. While IT had a process for deleting accounts for employees who left the company, sometimes the administrators in other departments wouldn’t do the same. That meant someone who had left the company could have potentially accessed sensitive data, depending on the applications the employee was using.
“That was the real security hole I wanted to plug,” Doyle said.
In addition, Okta shows IT administrators if employees are actually using individual services. That can help IT departments keep costs down by eliminating subscriptions for people who aren’t using services.
It’s a feature Doyle really appreciates. “For me, one of the most important things is managing adoption early in the process,” he said. “If you have good visibility into who’s logging in and when, it’s good data to have but it also gives you the opportunity to reach out to people. If you see a new user log in who hasn’t before, you can send an e-mail or pick up the phone and say, ‘did it go OK.'”
While some of the hosted applications Enterasys uses offer that kind of user data, some don’t. Plus, Okta offers it all from a centralized location. The Okta service also warns IT administrators about potential security issues, such as when someone tries to log in but fails a certain number of times.
Okta is initially focusing on companies with up to around 1,000 employees but expects to grow to accommodate large enterprises, McKinnon said. The service costs US$12 per user per month.
For Doyle, because Okta uses Active Directory, it serves as an important tool to unite cloud-based and on-premise apps. “It makes all of our cloud apps behave the same way as our on-premise apps behave,” he said. “We want to get to the point where our users can’t tell if they’re logging into a cloud app or an on-premise app.”