<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'><div dir='ltr'>
As I said to a Homeland security program manager for (US national-level initiatives in) SSO recently, you personally get a daily travel stipend from the Federal Goverment (even for conferences where vendors are providing food, etc) greater than the total annual revenue per user, in real estate IT systems management. And that 1 day's $60+ cash in your pocket is 30* the annual revenue for security/SSO/assurance features of that system. I.E. dont whine when mainstreet SSO clouds fail to deliver "Government-grade assurance". Vendors doing national-level real estate infrastructure are delivering security services at a level of annual revenue level per user that federal workers would sneer at as their personal daily travel stipend. Folks in government and folks in real estate are simply operating in different spending league; that are about 2 orders of magnitude apart. <BR> <BR>This is not a riticism of federal travel stipends. its a way of setting the scene for an economics argument on openid and openid connect.<BR> <BR>I say this on openid general as I know certain folks in the foundation-centric part of the community are VERY loyal to openid connect. They are still competing in a winner-takes-all world - working *against* SAML, ws-trust/fed, JWT, OAUTHv2 and then browserid and webid and the next 10 low-assurance schemes folks will come up with.<BR><br>Folls have to realize that things like openid connect WHEN BASED ON THAT WINNER_TAKE_ALL orientation are just too expense to *adopt* - because they are not economic at the macro-level. Its not the concept of the bridge that is uneconomic (since Im using Azure ACS in much the same role). Its the winner-takes all element, that makes it uneconomic to adopt. A viable connect has to do what the Microsoft Azure ACS does - and be multi-protocol, and as religion-free as possible. It is the multi-protocol'ness and the supprot for "legacy" that satisfy the conditions necessary for economic viability - WHEN the adopting communities economics is at the $1 a year per user, per anuum. <BR> <BR>Things may be different in the world where SSO is $100 a year per user revenue...such as in Sweden - and where the state provides vendors with indirect subsidies that allow the vendor to pass on the cost of the higher levels of assurnace (in smartcards, etc). But, this is not my reality. I suspect its not the reality of most vertical markets trying to deploy SSO at national scale - roughly according to the goals opf the US national initiative. The only bootstrap economics that works, given commodity pricing and baises due to venture capital etc, are (i) low assurance, and (ii) multi-protocol bridging.<BR> <BR> </div></body>
</html>