Whitepaper
November 2020

Get Your App
Ready for the
Global B2B
MarketUnderstanding the power ofenterprise identity integration
Okta Inc.
100 First Street
San Francisco, CA 94105
info@okta.com
1-888-722-7871

Whitepaper

Contents

Get Your App Ready for the Global B2B Market

2

Integrating B2B Enterprise Identities

5

Aspects of Federated ID Implementations

9

Leveraging Okta for Enterprise Identity Integration

13

User Model Use Cases

15

Facilitating Authentication and Identity Integration

16

Simplify ID Integration and Grow Your Business Faster1

Whitepaper

Get Your App Ready for the Global B2B Market

2

Seamless interactions with your enterprise partners and customers often require
Integrating
you
grant them access to enterpriseIdentities
applications or internal systems that you’ve
Integrating B2Bthat
Enterprisedeveloped or are developing. But in a world where each of your enterprise partners andB2B Enterprise
individual
usersoften
mightrequire
alreadythat
be managing
digitalto
identities, you
Seamless interactions with your enterprise customers’
partners andcustomers
you grantdozens
them ofaccess
don’t
want
to
jeopardize
their
user
experiencebyrequiringthem
tocreateyetyouranother
Identities
enterpriseapplications or internal systems that you’ve developed or are developing. But in a world where each of
identity to access your application or shared resources. To foster healthy relationships
enterprise partners and customers’ individual
users might already be managing dozens of digital identities, you don’t
and increase the adoption rate of your technical innovations and applications, youwant to jeopardize their user experience by requiring them to create yet another identity to access your applicationneed to create frictionless experiences that allow those users to use their existingor shared resources. To foster healthy relationships and increase the adoption rate of your technical innovations
enterprise identities.
and applications, you need to create frictionless experiences that allow those users to use their existing enterprise
identities.
There are a variety of ways to integrate your enterprise applications and internal systems
with your partners and customers’ identities. This paper discusses the most common● Manual ID administration● Self-service IDs● Google/Microsoft IDs● Federated IDs

LEVELS OF EFFORTThere are a variety of ways to integrate your enterprise applications and internal systems with your partners andmethods, exploring their different advantages and disadvantages.
customers’ identities. This paper discusses the most common methods, exploring their different advantages anddisadvantages.

Manual ID
administration

Self-service IDs

Google/Microsoft IDs

Federated IDs

Manual ID administration
Manually adding partner users and their passwords into enterprise applications
Self-service
IDs currently in use in enterprises. Although
and internal systems
is the oldest method
sometimes referredSelf-service
to as the traditional
method, theand is still a
Manually adding partner users and their passwords
allows individuals
in fact
yourthat
B2Bit’s
andoldB2Ccommon way to connect partners to an enterprise system doesn’t make it the best choice.

Manual ID administration

into enterprise applications and internal systems is therelationships to self-register their own user accounts into
oldest method currently in use in enterprises.
system. Since
individualusers
are the
only ones to have
TheAlthough
manual natureyourof assigningcredentials
not onlymeans
administrators
sometimes referred to as the traditional method,
the
fact
see
their
own
personal
identifiable
information(PII), it’shaven’taknowledge of users’ credentials, there’s no guarantees that those credentials
that it’s old and is still a common way to connect
partners orsignificant
step upin security
overNeither
the manual
integration
been intentionallyunintentionally
exposedto others.
enterprises
nor their
can affordmethod.
this levelof inherent mostrisk. But
if that’s methods
not enoughreason toto an enterprise system doesn’t make it thepartners
best choice.
Additionally,
self-service
also
influence organizations
tochooseanewer,
more
secureenterprise
identity
integration
include built-in password recovery workflows. So, if users
The manual nature of assigning credentials not only
option, then the lackforgetof scalability
in manual integration
should be.
administrative
their passwords,
they can recoveror Theupdatethemmeans administrators have knowledge of users’
overhead of adding all
thosedifferentusersandmanaging
theiraccount
lifecycles
fromwithout administrative intervention and overhead.
credentials, there’s no guarantees that those credentials
beginning to end is not sustainable as you and your partners grow.

haven’t been intentionally or unintentionally exposed
to others. Neither enterprises nor their partners canafford this level of inherent risk. But if that’s not enoughreason to influence organizations to choose a newer,
more secure enterprise identity integration option,then the lack of scalability in manual integration should
be. The administrative overhead of adding all thosedifferent users and managing their account lifecycles
from beginning to end is not sustainable as you and yourpartners grow.

While self-service IDs might be fine for B2C relationships,
it creates a significant burden for your B2B partners
since every user in the partner organization that needs toaccess your system needs to go through the registration
process. These users also become responsible forremembering or securely storing their newly createdcredentials. Shifting these burdens to your businesscustomers’ and partners’ users runs counter to yourdesire to nurture better B2B relationships throughfrictionless experiences.

Whitepaper

Get Your App Ready for the Global B2B Market

3

Self-service IDs
Self-service allows individuals in your B2B and B2C relationships to self-register theirown user accounts into your system. Since individual users are the only ones to see theirown personal identifiable information (PII), it’s a significant step up in security overthe manual integration method. Additionally, most self-service methods also include
built-in password recovery workflows. So, if users forget their passwords, they canrecover or update them without administrative intervention and overhead.
While self-service IDs might be fine for B2C relationships, it creates a significant
burden for your B2B partners since every user in the partner organization that needs
to access your system needs to go through the registration process. These users also
become responsible for remembering or securely storing their newly created credentials.
Shifting these burdens to your business customers’ and partners’ users runs counterto your desire to nurture better B2B relationships through frictionless experiences.
An additional downside of self-service IDs is that if or when your partner relationshipends, you need to make sure to eliminate each one of those self-service accounts toensure the security of your system and prevent unauthorized access. Often that requiresa manual administrative effort that consumes significant time, especially when yourdealing with large enterprises. There’s also the added security risk that with such adaunting manual effort, it can be extremely difficult to verify that every account has
been properly removed.

Google/Microsoft IDs
Sometimes known as bring your own identity solutions, these identity integration
scenarios allow users to sign in with their Google or Microsoft credentials to accessresources shared with customers or partners. This method has grown in popularity inrecent history since it reduces friction in the overall experience. Neither your customers,
partners, or administrative staff need to expend effort in creating and managing newuser profiles.
Since a large user base exists for both the Google and Microsoft platforms, this method
can greatly simplify enterprise identity integration. But the fact is that not everyone
has Google or Microsoft identities. As a result, this method can leave out some of yourcustomers’ and partners’ users, including identities created in homegrown systems
or applications with unique user bases, such as Github or Fitbit. Due to these user
exclusions this method might not meet your needs for enterprise identity integration
on its own, but when combined with ID federation it can deliver some strong benefits.

Whitepaper

Get Your App Ready for the Global B2B Market

4

Federated IDs
Since federation provides the most frictionless experience for users and administrators,
an increasing number of enterprises continue to choose it for enterprise identity
integration making it one of the most preferred methods. Under ID federation you andyour partner or business customer mutually agree to allow their users to use their own
enterprise identities to access authorized applications or services that you provide
or share. It does this by pairing your different identity systems through a metadata
exchange. This allows you to create a single sign-on (SSO) experience for their users
while giving them a familiar user interface.
With the exponential growth of partner ecosystems, federation offers enterprises
the best option for integrating identities in a way that enhances collaboration withpartners. It simplifies integration in a manner that provides frictionless experiences,facilitating your ability to quickly get your applications to market and adopted so you
can grow your business. That’s why it’s becoming a standard method of supporting
enterprise relationships. There are different ways to implement ID federation andthere are different aspects and use cases related to the technology that you should
be familiar with as you plan your enterprise ID integration strategy.

Whitepaper

Aspects of federated ID implementations
Get Your App Ready for the Global B2B Market

Delegated administration

5

Security and lifecycle mana

Delegated administration allows another entity to manage
An ID federation solution that provides
or administer their own users who access the application,
management is vital to simplifying man
services, or resources you provide or share. This could
your integrated IDs and keeping your e
include delegatingsome level administrationof administration rights tosecure. Through a central managemen
Delegated
your partners or business customers, such as the ability
more easily enforce policies across all
Delegatedadministration
allowsanother
entitytomanageor administer
their ownor cus
to grant and remove their own users’ access rights tothatyou authorize
your partners
users
who accessthe application,
services,you provide
or share.
This secur
your applications.
It could
also extend
to giving themthe or resources
For example,
you could
heighten
could
includedelegating
some
level
of
administrationrightstoyourpartnersorbusinessability to define the login experience for their users.
systems using multi-factor authenticati
customers, such as the ability to grant and remove their own users’ access rights toenforcing risk-based policies.
Delegated administration could also be used to give yourAspects ofFederated ID
Implementations

your applications. It could also extend to giving them the ability to define the login

partners or customers
complete
accessCentralized management also makes it
experience
for theirusers. over policy anduser management. This could be achieved by leveraging
access to users when a B2B relationsh
Delegatedadministration
could
also
be used to give yourpartners
or customers
completea cloud-based solutionforuser storage.
Suchsolutions
includethe ability
through
ID federatio
access over policy and user management. This could be achieved by leveraging a cloudprove to be more cost effective than on-premisescustomer’s or partner’s identity system
based solution for user storage. Such solutions prove to be more cost effective thansolutions based on client access license (CAL) scenarios.
system’s lifecycle management functio
on-premises solutions based on client access license (CAL) scenarios. Regardless of how
Regardless of how delegated administration is employed,
users’ access to your application. Havi
delegated administration is employed, it’s an important part of the trust relationshipit’s an important part of the trust relationship that two
effective means to grant and terminatethat two business entities enter into when creating relationships.
business entities enter into when creating relationships.
is critical to your ability to prevent syst
breaches.
Parent org
Resource
Delegation

CompanyB
Admin

CompanyB
User
InboundFederationorg.idp.com
App

Delegation

CompanyB
Admin

CompanyB
User

Legacy integration with mig

Some ID federation solutions can prov
access between cloud-based identity slegacy on-premises identity systems. T
a standards-based way of integrating dsystems, while providing a migration pa
proprietary system to a newer modern
does it without requiring you to create
experience for the old legacy system aservice.
Directory Support

administration

ministration allows another entity to manage
Whitepaper
heir own
users who access the application,
sources you provide or share. This could
ating some level of administration rights toor business customers, such as the ability
move their own users’ access rights to
ns. It could also extend to giving them thee the login experience for their users.

ministration could also be used to give yourstomers complete access over policy andent. This could be achieved by leveraging
solution for user storage. Such solutions
ore cost effective than on-premises
d on client access license (CAL) scenarios.
how delegated administration is employed,
nt part of the trust relationship that two
es enter into when creating relationships.
Parent org
Resource
Delegation

CompanyB
User

CompanyB
Admin

InboundFederationorg.idp.com
App

Security and lifecycle management
An ID federation solution that provides centralized
Get Your App Ready for
Globalto
B2B
Marketmanagement
isthevital
simplifying
management of
your integrated IDs and keeping your environments
secure. Through a central management point you canmore easily enforce policies across all the applications
that you authorize your partners or customers to use.
For example, you could heighten security on sensitive
systems using multi-factor authentication (MFA) and by
Securityand lifecycle
enforcingrisk-based
policies. management

6

Centralized
management
alsoprovides
makes centralized
it easier to management
revokeAn ID federation
solution thatis vital to simplifying
access
to
users
when
a
B2B
relationship
ends.
This
might
management of your integrated IDs and keeping your environments secure. Throughincludethemanagement
ability throughID federation
to tieinto enforceaa centralpoint
you can moreeasilypolicies across all thecustomer’s
partner’s
identityyour
systemto leverage
their to use. For example, you
applicationsorthat
you authorize
partners
or customers
could heighten
securityon sensitive
systemstousing
multi-factor authentication (MFA)
system’s
lifecycle
management
functionsterminate
and byaccessenforcingrisk-based
policies.
users’
to your
application.
Having a simple andeffective means to grant and terminate authorized accessCentralized management also makes it easier to revoke access to users when a B2B
is critical to your ability to prevent system abuses andrelationship ends. This might include the ability through ID federation to tie into a
breaches.
customer’s or partner’s identity system to leverage their system’s lifecycle management
functions to terminate users’ access to your application. Having a simple and effectivemeans to grant and terminate authorized access is critical to your ability to prevent
Legacyintegration with migration
system abuses and breaches.

Some ID federation solutions can provide bridged
Legacyintegration
withmigrationaccessbetweencloud-based
identity
services andlegacy on-premises identity systems. This can provide
Some ID federation solutions can provide bridged access between cloud-based identity
a standards-based way of integrating disparate identity
services and legacy on-premises identity systems. This can provide a standards-based
systems,
while providing
a migration
path froma providing
legacy, a migration path from away of integrating
disparate
identity systems,
while
proprietarysystemsystem
to a newer
modernsystem.
AndAndit it does it without requiring
legacy, proprietary
to a newer
modernsystem.
does
it without
create a separate
login
you tocreate arequiring
separate you
logintoexperience
for the oldlegacy system and the newexperience
for
the
old
legacysystem
and
the
new
cloud
cloud service.
service.
Directory Support

Delegation

SaaS
CompanyB
Admin

CompanyB
User

Flexible and secure user models
Whether it’s a mix of customer, employee, or partner users, the types of users youneed to account for when integrating enterprise identities vary from one relationshipto another. The makeup of your relationship’s user model will 4
be a key influencer on
how you address customer data access, data separation, and user experiences in youridentity integration strategy. To handle these different scenarios, an ID federation
solution that enables you to easily connect to different identity providers can give you
much needed flexibility when it comes to architecting your user structure.
The following are some of the most common user models that organizations deal withwhen integrating enterprise identities:
Customer and employee user models
Customer, partner, and employee user models• SaaS to multi-customer user models••

Whitepapernd secure user models
mix of customer, employee, or partner

es ofsecureusers youuserneed models
to account fornding enterprise identities vary from one
mix of customer, employee, or partnero another. The makeup of your relationship’s
es of users you need to account forll be a key influencer on how you
ing enterprise identities vary from one
mer data access, data separation, ando another. The makeup of your relationship’s
ces in your identity integration strategy.
ll be a key influencer on how you
se different scenarios, an ID federation
mer data access, data separation, andenables you to easily connect to different
ces in your identity integration strategy.
ders can give you much needed flexibility
se different scenarios, an ID federations to architecting your user structure.
enables you to easily connect to different
are someof themodelsders
can give
youmostmuchcommon
neededuser
flexibility

deal with whenenterprisesons
to architecting
yourintegratinguser structure.

are some of the most common user models
erand
employeeusermodels enterpriseons
dealwith when
integrating

er, partner, and employee user models

erand employeeuser
usermodels
modelsmulti-customer

Get Your App Ready for the Global B2B Market

When it comes to the customer identities you maintain foryourB2B andand
B2Cemployee
relationships,
thosecustomer identity
Customeruser
modelsprofiles often need to be stored in a separate identity
When it comes to the customer identities you maintain forsystem than where your organization stores identity
your B2B and B2C relationships, those customer identity
profiles for its internal employees. This separation of
profiles often
to beuser
storedin a separate identity
Customerand need
employeemodelsidentity data helps you safeguard customers’ personal
system than where your organization stores identity
identifiable
information(PII) from identities
unauthorizedWhen
it comes
to the customer
you accessmaintain for your B2B and B2C
profiles for its internal employees. This separation of
anddata
breaches,
while
enabling
authorizedinternal
relationships, those customer identity profiles often need to be stored in a separate
identity data helps you safeguard customers’ personal
identity systemthanorganization
storesandidentity profiles for its internal
employees,
such
as wherecertainyour
marketingpersonnel
identifiable information (PII) from unauthorized accessemployees.
This separation
ofinformation
identity dataas
helps
you safeguardcustomers’ personal
IT staff, to accesscustomerneededforand data breaches, while enabling authorized internal
identifiable
information
(PII)
from
unauthorizedaccessanddata
breaches,
while enabling
marketing and administration purposes.
employees,suchascertainmarketingpersonnel
andauthorized internal employees, such as certain marketing personnel and IT staff, toITstaff,customer
to accessinformation
customer informationneeded foraccessas needed forasmarketing
and administration purposes.
Customer
Employeemarketing and administration purposes.
CustomerA
Employee

EmployeeA
Employee
Federation

Employee A
Customer

Employee A
Federationer, partner, and employee user models

multi-customer user models

7

Customer and employee user models

Customer

Customer, partner, and employee user models
When you add partner users to a customer and employee
user
model,partner,youneedalsoemployee
segregate
thestorageof
Customer,
andto
employeeuser models
Customer,partner,andusermodelsthe identities associated with the partner’s users. This
When youyouaddaddpartner
partnerusers
a customer
employeeWhenusers
to atocustomer
and andemployeeuser model, you need to also
multi-tenancy requirement should allow you to maintainuser
model,
you
need
to
also
segregate
thestorageofsegregate the storage of the identities associated with the partner’s users. This multipartners and partner portals in one tenant, customers
the identities
associatedwiththeyoupartner’susers.
This and partner portals in one
tenancyrequirement
shouldallow
to maintainpartners
and customer-specific apps in another tenant, andtenant,customers
and customer-specificin maintainanother tenant, and employees in
multi-tenancy
requirement
should allow apps
you toemployees in yet another tenant. Your ID federation
yet
anothertenant.
Your
ID
federation
solutionshouldgive your administration teampartners and partner portals in one tenant, customers
solutionshouldgive
youradministration
team
theabilitytheto manage all apps
three inuser
types throughfederation.
andability
customer-specificanothertenant, andto manage all three user types through federation.
employees in yet another tenant. Your ID federation
solution should give your administration team the ability
Customer
EmployeePartner
to manage all three user types through federation.
CustomerA
Employee

EmployeeA
Employee
Federation

Employee A
CustomerFederation
Employee A

Federation
CustomerPartner A
Employee

Employee A
Partner
Federation
Partner55Whitepaper

SaaS
to multi-customer user models
Get Your App Ready for the Global B2B Market
Many software companies moving to the cloud want tomove away from on-premises solutions for storing user
identities and profiles. To do this, some create an identity
provider, add their customers’ and partners’ users to it,
and then assign those users the appropriate resource
accesses. But this can be a complex undertaking for

SaaSsoftware
to multi-customer
user
modelsmany
as a service(SaaS)
providers, especially

Leveraginenterprise
integration
8

The applications you bui

create are the things tha
those
that
have
a
delegation
subscription
model
that
business.
That’s your exp
Many software companies moving to the cloud want to move awayfrom on-premises
allowstheirforpartners
customers
resellservices
Anythingthat
distracts yo
solutionsstoring or
user
identitiesto
andprofiles.
To do this, somecreate an
identity
orprovider,application
licenses
to othercustomers
or partners.
impacts
yourability
add their
customers’
andpartners’ users
to it, and then assign
those
users
the to deresource
accesses.
But thisSaaS
can bevendors
a complex
undertaking
for many Having
softwareto buil
outcomes.
Inappropriatethese complex
kinds
of scenarios,
have
as
a
service(SaaS)
providers,
especially
those
that
have
a
delegation
subscription
identity integration functto create unique user stores for all the downstream
model that allows their partners or customers to resell services oryour
application
licensesability toachieve th
customers and partners, and then connect those user

to other customers or partners.
where Okta can help.
stores to the parent identity provider that maintains theaccessinformation
for their
cloud-hosted
software.
Throughitsstores
identityIn thesecomplex kindsof scenarios,
SaaS vendors
haveToto create uniqueuser
for cloudeffectively
implement
this userandmodel,
the ID
federation
all the downstream
customers
partners,
andthen connect thoseuser stores
tofacilitates
thesolutions,Okta
parent identity
providermaintainsthe
thegranting
access informationforcloud-hosted
solutionneeds theabilitythat
to facilitateoffortheir
all yourB2B and B2C
software.
To
effectively
implement
thisuser
model,
theID
federation
solutionneeds yourpolicy and user management to downstream customers
the task of building

thepartners
ability towhen
facilitate
the granting
policy andto downstream
andappropriate.
Thisofrequires
theuser management
connections
for your diffcustomers
andpartners
whenappropriate.
This
requirestheabilitytoprogrammaticallyability to programmatically create an identity provider
even separate internal bu
create an identity provider and configure its connection back to the main parent resource.

and configure its connection back to the main parent
resource.
SaaS

can get to market faster arelationships by giving yo
secure and frictionless aand need.

Employee

SSO to SaaS

Customer A

Customer B

Customer C

Customer A

Customer B

Customer C

Whitepaper

Leveraging
Okta for
Enterprise
Identity
Integration

Get Your App Ready for the Global B2B Market

9

The applications you build and the web services you create are the things that bringreal value to your business. That’s your expertise. That’s your focus. Anything that
distracts you from that focus negatively impacts your ability to deliver expectedbusiness outcomes. Having to build your own authentication and identity integration
functionality disrupts and distracts your ability to achieve those business outcomes.
That’s where Okta can help.

Through its identity cloud and Okta’s Customer Identity solutions, Okta facilitatesenterprise identity integration for all your B2B and B2C use cases. It frees you fromthe task of building your own authentication and identity connections for your different
partners, customers, and even separate internal business units. As a result, you can gettomarketfaster and foster
better B2B and B2C relationships by giving
yourConnect
partners and O
OpenID
Okta
InboundFederationand customers the secure and frictionless access to your services they
want
and
need.
With the onsetof the e

The inbound federation functionality in Okta allows yourthe API economy, OpenOkta tenant to act as a service provider, granting external
are becoming the new
identities
access to Federation
your Okta protected application
Okta
Inbound
2.0 is an open standard
or website. While this is a role reversal of traditional
designed to support aThefederationin Okta allows
your forOkta tenant to act as a service
SSOinboundsolutions,
it givesfunctionality
you consumption
endpoints
Connect
sits on or
top ofprovider,granting
external
identities
accessto creation,
your Okta protected
application
authentication,
enablesjustin time (JIT)
user
provide authentication.
website.
Whilethis isto
a rolereversalconnectionsof traditional SSO
and makes
it easyterminate
withsolutions,other it gives you consumption
Connecta differen
endpoints for authentication, enables just in time (JIT) user creation,and takemakes
itenterprise entities. It also provides identity provider
than
SAML.identity
They work
easy to terminate connections with other enterprise entities. It also
providesdiscovery (IDP discovery) functionality, which adds aand engine
accesstomanageme
provider discovery (IDP discovery) functionality, which adds a rules
yourrules engine to your login flow that directs users to thelogin flow that directs users to the appropriate IDP login page basedon setacriteria.
supportwider variety
appropriate IDP login page based on set criteria.
experiences, and devic
SSO Usewith Okta
as the IDPFederation
Use with Okta
as the SP

Service
Provider

3rd Party
IDP

OpenID Connect at ww
To discover how to con

using OpenID Connect
Authentication Guide.

SocialOkta allows you to implement inbound federation withOkta allows you to implement inbound federation with either the Security Assertion
either the Security Assertion Markup Language (SAML
Markup Language (SAML 2.0) protocol or the OpenID Connect (OIDC).
IDP
2.0) protocol or the OpenID Connect (OIDC).
For
ProvidersAPI
documentation page.
For moremoreinformation,
information,visit
visitour
ourIdentity
Identity
ProvidersAPI

documentation page.

SAML
For years SAML has been the gold standard forfederation in the enterprise space. It allows you to use
a set of attributes to identify a user. It’s secure and easy
to setup. While it is still a great solution and will work formost enterprise ID integrations, SAML 2.0 was developedin 2005. Technology has changed a lot since then and it
might not be the best choice in today’s fast paced, highly

Org2Org

Pre-built Identity

In a recent study, 77 pe
indicated that the abilit
providers as well as theproviders was equally bfacilitating the creation
provides pre-built ideneither the Security Assertion Markup Language (SAML
IDP

2.0) protocol or the OpenID Connect (OIDC).

Whitepaper

Get Your App Ready for the Global B2B Market

For more information, visit our Identity Providers API
documentation page.

SAML
For years SAML has been the gold standard forfederationin the enterprise space. It allows you to use
SAML

10

Org2Org

Pre-built Identity provi
In a recent study, 77 percent of

indicated that the ability to crea
providers
as well as
the desire
years
SAML
beensolution
the goldand
standard
for federationin the enterprisespace.
It
to setup.For
While
it is
still ahas
greatwill workforproviderswasequallybalancedallows you
use a set ofSAML
attributes
to identify
a user. It’s secure and easy to setup.
most enterprise
ID tointegrations,
2.0 wasdeveloped
facilitating
the creationof custo
While it is still a great solution and will work for most enterprise
ID integrations,SAML
in 2005. Technology has changed a lot since then and it
pre-built
identity
2.0 was developed in 2005. Technology has changed a lotprovides
since thenand it might
not prov
might not be the best choice in today’s fast paced, highly
be the best choice in today’s fast paced, highly mobile world.
enterprise business providers, mmobile world.
integrate with Google and Micro
OpenID Connect and OAuth 2.0
nd Federation
For more information, visit ourWith the onset of the exponential growth of apps anddocumentation page.
eration functionality in Okta allows yourthe API economy, OpenID Connect and OAuth 2.0
ct as a service provider, granting external
SAMLfederation standard. OAuth
are becoming the news to your Okta protected application
2.0 is an open standard authorization framework
e this is a role reversal of traditional
designed
supportanda variety
OpenID toConnect
OAuth of2.0use cases. OpenID
gives you consumption endpoints forConnect sits on top of the OAuth 2.0 framework to
enables just in time (JIT) user creation,
With theonset of the Together,
exponential
growthapps and the API economy, OpenID
provideauthentication.
OAuth
andofOpenID
sy to terminate connections with other
Connect and OAuth 2.0 are becoming the new federation standard. OAuth 2.0 is an
Connect take a different approach to federation
es. It also provides identity provider
open standard authorization framework designed to support a variety of use cases.
than SAML. They work together to provide identity
iscovery) functionality, which adds a
OpenID Connect sits on top of the OAuth 2.0 framework to provide authentication.
and access management using scopes and claims to
Together, OAuth and OpenID Connect take a different approach to federation thanyour login flow that directs users to the
support a wider variety of deployment models, user
SAML. They work together to provide identity and access management using scopes
login page based on set criteria.
experiences,anddevices.
You canlearn
more about models, user experiences, andand claims to
supporta widervarietyof deployment
a set of attributes to identify a user. It’s secure and easy

Federation
Use with Okta
as the SP
3rd Party
IDP

to implement inbound federation with
ity Assertion Markup Language (SAML
the OpenID Connect (OIDC).

mation, visit our Identity Providers API
page.

has been the gold standard fore enterprise space. It allows you to uses to identify a user. It’s secure and easyt is still a great solution and will work for
ID integrations, SAML 2.0 was developed
logy has changed a lot since then and it
best choice in today’s fast paced, highly

OpenID
Connect
at www.okta.com/openid-connect.
devices.
You can learn
more about OpenID Connect at www.okta.com/openid-connect.
ToTo
discoverhowtoconnect
discover how to connectenterpriseenterprise identities
identities using OpenID Connect with Okta,
using
Connect with
Okta, visit thevisitOpenID
the Authentication
Guide.
Authentication Guide.

SocialIDP

Org2Org

Pre-built Identity providers
In a recent study, 77 percent of IT professionals surveyed
indicated that the ability to create custom identity
providers as well as the desire for pre-built identity
providers was equally balanced. As such, in addition tofacilitating the creation of custom identity providers, Okta
provides pre-built identity providers for the most common
enterprise business providers, making it fast and easy tointegrate with Google and Microsoft out of the box.
For more information, visit our Social Loginurity Assertion Markup Language (SAMLIDPr the OpenID Connect (OIDC).
Whitepaper

mation, visit our Identity Providers APIn page.

L has been the gold standard forhe enterprise space. It allows you to use

tes to identify a user. It’s secure and easy

it is still a great solution and will work fore ID integrations, SAML 2.0 was developed
nology has changed a lot since then and it

he best choice in today’s fast paced, highly

Get Your App Ready for the Global B2B Market

11

Org2Org

Pre-built Identity providers
In a recent study, 77 percent of IT professionals surveyed
indicated
thatIdentity
the ability tocreate custom identity
Pre-built
providersproviders as well as the desire for pre-built identity

In a recentwas
study,
77 percentof IT professionals
surveyedtoindicated that the ability toprovidersequallybalanced.
As such, in addition
create custom
identity providers
asidentity
well as thedesire forpre-built identity providers
facilitating
the creationof custom
providers,Okta

was equally balanced. As such, in addition to facilitating the creation of custom identity

provides pre-built identity providers for the most common
providers, Okta provides pre-built identity providers for the most common enterpriseenterprise business providers, making it fast and easy tobusiness providers, making it fast and easy to integrate with Google and Microsoft
out of the box.

integrate with Google and Microsoft out of the box.

For more information, visit our Social Login
For more information,
documentation
page. visit our Social Login documentation page.

SAML

Directory integrations

Multi tenancy

Many organizations have made significant investments
into on-premises identity solutions with deep integrations

As software companies and service
the cloud, they are faced with the cthat pre-date many of today’s cloud applications. These
organizations don’t have to abandon their investments
or integrations
to move tointegrations
the cloud. Tying into either
Directory

SSO into their products and service
identity connections with their busi
business customers. Building those7
their Active Directory or LDAP on-premises identity
authentication
capabilities take tim
Many organizations have made significant investments into on-premises identity
stack, Okta provides directory integrations that enable
delays their ability to deliver the cosolutions with deep integrations that pre-date many of today’s cloud applications.
organizations to take advantage of legacy solutions inadded features with the immediacy
These organizations don’t have to abandon their investments or integrations to movea hybrid on-premises and cloud deployment model.
demand. That’s why many of theseto the cloud. Tying into either their Active Directory or LDAP on-premises identity stack,So, as you look to integrate enterprise identities in yourOkta. Using Okta and the Okta API
Okta provides directory integrations that enable organizations to take advantage ofenterprise customer and partner relationships, thesecreation functionality, software andlegacy solutions in a hybrid on-premises and cloud deployment model. So, as you lookdirectory integrations
Okta allow
yourincustomers
use Okta
their relationships,
identity layer andto integratefrom
enterprise
identities
your enterprise customer
andas
partnerand partnerstheseto takeadvantage
of
your
cloud
offering
access
to
their
own
Okta
tenant, whdirectory integrations from Okta allow your customers and partners
to takeeven if they advantage
need to orofwant
continueusing
ID federation.
yourtocloud
offering
eventheir
if they need to control
or wantvia
to continue
using theiron-premiseson-premises
identity systems.
identity systems.

For more information,
visit our Supported
Directory Directory integrations
For more information,
visit our Supported
integrationsdocumentation
documentationpage.
page.

Consumers

Consumers

AD or LDAP
Consumers

Consumers

Consumers

Whitepaper

Get Your App Ready for the Global B2B Market

12y integrations

Multi tenancy

zations have made significant investments
ises identity solutions with deep integrations
e many of today’s cloud applications. Theses don’t have to abandon their investments

As software companies and service providers move tothe cloud, they are faced with the challenge of building
SSO into their products and services, as well as building
identity connections with their business partners andns to move to the cloud. Tying into either
Directory or LDAP on-premises identity
provides directory integrations that enable
s to take advantage of legacy solutions inpremises and cloud deployment model.

ok to integrate enterprise identities in yourustomer and partner relationships, theseegrations from Okta allow your customers
to take advantage of your cloud offeringneed to or want to continue using theirMultitenancybusinesscustomers. Building those connections andauthentication capabilities take time and expertise, which

As software companies and service providers move to the cloud, they are faced withdelays their ability to deliver the core services and valuethe challenge of building SSO into their products and services, as well as building
added connections
features withthetheir
immediacy
thattheir customers
identitywithbusiness
partners
and business customers. Building
demand.
That’s
why
many
of
these
businesses
turntoand expertise, which delays
those connections and authentication capabilities take
time
Okta.
Using
Okta
and
the
Okta
API’s
automated
tenanttheir ability to deliver the core services and valueadded features with the immediacy
creationfunctionality,
softwarecan turn to Okta. Usingthat
their customers
demand.
That’sandwhyservice
many ofproviders
these businesses
use andOkta
theirAPI’s
identitylayer andgive
their customers
Okta
theasOkta
automated
tenantcreationfunctionality, software and service
providerscanuse own
OktaOkta
as theiridentitylayer
andgive their customers access to theiraccess totheirtenant,while
stillretainingown
Oktaviatenant,while still retaining control via ID federation.
control
ID federation.

identity systems.
Consumers

ormation, visit our Supported Directory
documentation page.

Consumers

Consumers

AD or LDAP
Consumers

Consumers

Consumers

Consumers

Consumers

8

Whitepaper

User Model
Use Cases

Get Your App Ready for the Global B2B Market

13

As previously discussed, organizations deal with a variety of user models when trying
to integrate enterprise IDs. In both B2B and B2C relationships, Okta has simplified
this effort for a broad spectrum of organizations across all these different types ofuser scenarios.

Customer and employee use caseBazaarvoice has 750 employees accessing a suite of internal and external applications,more than 590 million shoppers who use Bazaarvoice apps each month to speak tobrands, and 10,000 client users in 80 countries who log into Bazaarvoice apps tocapture consumergenerated content. Okta makes sure Bazaarvoice employees getaccess to the applications they need, while giving its application developers an identityand authentication platform they can leverage when building client applications.
Read the full story at www.okta.com/customers/bazaarvoice.

Customer, partner, and employee use caseAs a global manufacturing firm, Flex has about 200,000 employees connected tocloud and on-premises apps, thousands of suppliers with fluctuating access to its
supply chain, and more than 100 factories connected to its supply chain, customers,
and company. Okta provides Flex a unified identity platform that secures its supply
chain for its partner and business customers, while connecting its employees withthe apps they need.
Read the full story at www.okta.com/customers/flex

Okta plays a role in all threeof my initiatives: Cyber security,business productivity, and bestof breed. It fits all three, so it’sa perfect match.
Gus Shahin
CIO, Flex

Whitepaper

Get Your App Ready for the Global B2B Market

14

SaaS to multi-customer use case
Adobe uses Okta as its authentication layer for both internal employees and for its
Adobe Creative Cloud suite of software. That translates into more than 20,000 Adobe
employees using Okta for SSO into 300 enterprise apps, as well as thousands of Adobe’s
business customers using Okta to access the Adobe Creative Cloud suite of products.
Read the full story at www.okta.com/customers/adobe-systems

I don’t want to reinvent the wheel
in our identity stack. I want to use
what’s best in class in the market
and then apply the Adobe specificrequirements to that stack to getsomething out to our customers
really quickly.
Scott Castle
Adobe Creative Cloud, Product Manager, Adobe

Whitepaper

Get Your App Ready for the Global B2B Market

Facilitating
Authentication
and Identity
Integration

Okta provides a wide variety of SDK’s to help organizations quickly take advantageof the power of the Okta Identity Cloud platform to securely connect businesses andpeople to the technologies they need. Okta provides a wide range of SDKs to help you
get started in your preferred language, while the Okta Toolkit provides community
generated code and solutions that have helped thousands of enterprises take advantage
of Okta and its highly secure, global redundant infrastructure. The Okta SDKs andOkta Toolkit can be accessed at toolkit.okta.com.

15

In addition to its SDKs, organizations can take advantage of Okta services directly
through its API and the new API endpoint enhancements that Okta continues to provide.
Using the API, organizations can script the entire authentication process behind theirnormal login pages. This includes being able to custom build admin pages or self-service
portals that organizations can use to allow partners to connect with the organization
without manual intervention from a support team.

acilitating
uthentication andentity integration

provides a wide variety of SDK’s to help
nizations quickly take advantage of the power ofOkta Identity Cloud platform to securely connect
esses and people to the technologies they need.
provides a wide range of SDKs to help you get

ed in your preferred language, while the Okta
it provides community generated code andons that have helped thousands of enterprises
advantage of Okta and its highly secure, global
ndant infrastructure. The Okta SDKs and Okta
it can be accessed at toolkit.okta.com.

dition to its SDKs, organizations can takentage of Okta services directly through its API

he new API endpoint enhancements that Oktanues to provide. Using the API, organizations
cript the entire authentication process behind

normal login pages. This includes being able tom build admin pages or self-service portals thatnizations can use to allow partners to connect withrganization without manual intervention from a

ort team.

ANDROID

ANGULAR

REACT

iOS

JAVASCRIPT

VUE

JAVA

.NET

NODE JSRESETWhitepaper

Get Your App Ready for the Global B2B Market

Simplify ID
Integration
and Grow Your
Business FasterToday’s expanding partner economy requires the ability to integrate with other identity
providers, while meeting customer expectations for secure and easy to use applications.
But building identity integrations to connect with enterprise partners and customers is
a complicated and difficult endeavor that shouldn’t distract your valuable development
resources from focusing on the development of services and features that grow yourbusiness and meet customer demand. Okta lets you leverage its identity expertise andservices, so you can focus on what matters most to your business.

16

With Okta serving as the identity layer for your infrastructure stack, you can free up
your resources to focus your development efforts and resources on your businessinitiatives, while fully addressing the needs of your partners and customers. Okta’s
Customer Identity solutions give you the tools and services you need to not only simplify
enterprise identity integration, but its futureproof approach and ongoing innovations
will give you the agility to evolve your product security and customer experience asworld and market forces evolve.
To take advantage of Okta or learn more about how it simplifies enterprise ID integration,
visit our B2B Integration page. To get started with a free trial, visit developer.okta.com.

About Okta
Okta is the leading independent provider of identity for the enterprise. The Okta
Identity Cloud enables organizations to securely connect the right people to theright technologies at the right time. With over 6,500 application integrations,Okta customers can easily and securely use the best technologies for their business.
To learn more, visit okta.com.