01.27.2016 - Why You Need TOTP

Static Passwords Alone, Are A Thing of the Past. Gone are the days where a username and password alone are secure enough for an organizations sensitive data.Static passwords can easily be cracked or stolen, leaving your sensitive information vulnerable to hackers or unauthorized users. The worst part about that is you don’t even know that a password has been compromised until it’s too late. Vulnerabilities can even create headaches for managers as the weak authentication can leave users unaccountable for their actions. Another issue with static passwords is, let’s be honest, it’s hard to remember all the different passwords you have for all of the different accounts that you need to access. Forgotten passwords create not only a hassle for you, but also a lot of extra time wasted by your helpdesk or IT department that should be spent on more important issues. ...

01.5.2016 - It’s So Meta (data)

One of the key enabling technologies in Federation is Metadata. In the early days of SAML (yes there was a SAML 1.0) one of the more difficult aspects of setting up a federation relationship was exchanging signing certificates and unique identifiers. This often involved emailing public certificates and URNs back and forth, and in some cases, multiple times. In SAML 2 the problem got even worse because in addition to the sign on endpoints from SAML 1.0, there were now sign off endpoints to consider as well as more bindings. ...

12.17.2015 - LDAP Migrations Made Easy – Part 2

LDAP iconIn LDAP Migrations Made Easy – Part 1, we discussed several common migration challenges dealing with schema,  paging and Directory System Agents (DSA’s) that can easily be avoided by using a Virtual Identity Server. In this post we will cover several other challenges involving Directory Information Trees (DIT’s), Access Control Lists (ACL’s) and password migration and how to overcome them with the end result being an efficient, seamless and secure migration. ...

12.10.2015 - That Synching Feeling I Get From Cloud SSO

Single Sign-On is all the rage these days.  Organizations are looking to ease the hassles and expenses related to user passwords.  Single sign-on (SSO) is a user authentication process that permits a user to enter one name and password in order to access multiple applications.  This can help reduce the number of calls to a help desk for access issues, thereby reduce the operating cost for the organization.  The latest market trend is to take this a step further and leverage external companies for SSO.  By using products that offer SSO as software as a service (SaaS), an organization can greatly reduce the expense related to the management of these integrations. However, when an organization moves their SSO infrastructure into “the cloud” there are new risks to be considered. sinking feeling definiton ...

11.20.2015 - LDAP Migrations Made Easy

Are you trying to migrate off an expensive directory platform (e.g. Oracle directory Server) to something more economical (e.g. Active Directory or AD LDS)?  Are you finding the LDAP migration process difficult or perhaps even impossible? Do you wish there was one proven solution that would eliminate all of the trials and tribulations you are currently facing? I have three words for you…Virtual Identity Server. Anyone can do an LDAP migration with the Virtual Identity Server…well…almost anyone! ...

11.12.2015 - Stop Data Leakage. Don’t Be the Next High-Profile Hack

Large company data breaches and hacks are becoming common place these days.  It seems like every week there is a new news story where a high-profile company’s data is compromised.  From T-Mobile to Ashley Madison, personal information is being stolen by hackers.  The recent Internal Revenue Service (IRS) hack showed us that even the United States government isn’t safe. As a result, consumer confidence in companies’ ability securely store their data is at an all-time low. ...

11.5.2015 - Cloud Federation & SSO Vendor Comparison

With so many cloud federation and single sign-on vendors in the market today, it can be difficult and extremely time consuming to research, test and ultimately decide on a solution that best meets the identity management needs of your organization. Most enterprise architects immediately think of big name providers like Okta, Ping and OneLogin who appear to be some of the largest competitors in the space. One should not overlook, however, the limited feature set and expensive nature of these solutions. Optimal IdM offers an all in one cloud federation and single sign-on solution that is affordable and fully customizable in order to meet the unique identity management needs of enterprise organizations. The competition simply cannot offer what Optimal IdM offers in The OptimalCloud. Let’s compare: ...

10.30.2015 - Bridging the OAuth2/SAML2 Divide

It’s no secret that OAuth2 and OpenID Connect are gaining in popularity. It seems that all of our customers are in the process of rolling out OAuth2 and OpenID Connect, or are thinking about it. But how can these newer protocols play nicely in your enterprise if you already have a SAML2 or WS-Federation infrastructure? The answer is an identity broker (also known as a federation proxy). ...

10.15.2015 - Benefits of a Cloud Federation Broker

Before diving into the benefits of a cloud federation (SAML or WS-Federation) broker, let me first cover what it is.  You can think of a cloud federation broker as a gateway or proxy server that all federation request go through.  Optimal IdM’s federation broker (The OptimalCloud) is a cloud service that contains one or more trusts to an on premise Identity Provider (IdP) or trust to a customer/business partner, which users authenticate with their local credentials, and a trust for each federated application (both on premise and cloud hosted applications), see picture below.   broker-mode-graphic The main benefit for this federation model, is to limit the administration burden of the corporate IT staff in terms of supporting the future of hundreds and even thousands of federated applications that are currently being deployed or will be deployed.  In this case, the IT staff is constantly having to work with each and every application team to setup and troubleshoot that application roll-out. With the federation broker, all of that administration is done by the cloud broker staff at Optimal IdM.  The central IT staff only has to setup the trust with the broker for their IdP, then provide documentation to each application team with instructions on how to integrate with the cloud broker.  The typical cost of this solution is less than 1 full-time employee, but the benefits are far reaching that include the following: ...


  • The database in which all of your organization’s sensitive identity data is stored.
  • A digital ledger in which digital transactions are recorded chronologically and publicly.
  • Securely managing customer identity and profile data, and controlling customer access to applications and services.
  • The means of linking a person's electronic identity and attributes, stored across multiple distinct identity management systems.
  • A legal framework that sets guidelines for the collection and processing of personal information of individuals within the EU.
  • The policy-based centralized orchestration of user identity management and access control.
  • An authentication infrastructure that is built, hosted and managed by a third-party service provider.
  • A security system that requires more than one method of authentication from independent categories of credentials to verify the user's identity for a login or other transaction.
  • A global provider of innovative and affordable identity access management solutions. 
  • Managing and auditing account and data access by privileged users.
  • Tools and technologies for controlling user access to critical information within an organization.
  • An authentication process that allows a user to access multiple applications with one set of login credentials.