Avoid the Hidden Costs

of AD FS with Okta

Okta Inc.
301 Brannan Street
San Francisco, CA 94107
[email protected]
1-888-722-7871

White paper

Contents
1 Challenges of Single Sign On Deployments
1 Key Elements of a Successful SSO Solution
2 Active Directory Federation Services as a SSO Solution
4 Okta: SSO for All Your Cloud, Web and Mobile Applications
5 The Hidden Costs of AD FS
6 Okta versus AD FS Quick View Comparison
6 Getting Started with Your Free Trial
6 About Okta

White paper

Challenges of Single-Sign On
Deployments

Key Elements of a Successful

SSO Solution

As everyone knows, the adoption rate of cloud applications has

There are many items to consider when investigating SSO

been dramatic in recent years. Trials of applications like Salesforce.

implementation options. It helps to focus on a few key elements

com, WebEx, or NetSuite have transitioned to enterprise-wide

to ensure success. While many of these checkboxes may not

deployments, and many organizations have, as a result, either

appear to be a major issue initially, over time as companies and

devised policies for cloud applications or are looking to do so in

applications scale, these items can become more frustrating for

near future.

companies and end-users.

However cloud adoption is not without its challenges. The

tendency of cloud applications to be siloed has made managing

Application Integrations and Support

user access and authorization an increasing challenge. The task of

The ability to support all of your applications, both today and in the

onboarding users is a time-intensive, manual process that involves

future, should always be considered when looking at a company-

administrators across multiple departments, which can also

wide solution. There may be one or two cloud applications to

introduce risk. For example, because there is frequently no central

integrate today, but what is your companys longer-term strategy?

user directory, when an employee leaves an organization their

access is often not revoked right away.

As your applications scale, they may have different configuration

requirements that may change over time, requiring an IT admin

As a result, many enterprises today are looking to implement a

to stay on top of individual apps. The labor and setup associated

single-sign on (SSO) solution that enables their users to easily

with each application can become a drain on both employees and

access all of their cloud and web applications. A key requirement

IT budgets.

of these solutions is Active Directory integration, i.e. connecting

all of their cloud applications back to a single source of truth,
Active Directory.

Availability
Any downtime associated with your SSO deployment means

Many companies conclude that Active Directory Federation

downtime for your users. This downtime may be planned, but it

Services (AD FS) is the best way to make AD integration happen.

may also be unexpected. An SSO service and associated support

After all, both Active Directory and AD FS are from Microsoft, so

must be agile to work with application configuration updates that

that should be the best choice, right?

may be altered by the provider. Ultimately any downtime means

Its important to realize that not all Active Directory integration

solutions are created equal, and IT departments should examine
all aspects of implementation when considering AD FS for a SSO

employees are not getting the access they require to do their job
lowering productivity for end-users.

solution. One example is that AD FS is not exactly free. There are a

User and Access Management

number of hidden costs associated with it such as setup, ongoing

Given a main value proposition for SSO is to support end-user

support and hardware requirements. Secondly, if youre looking for

productivity; user management should be inherently simple for

a complete identity and mobility management solution, AD FS is

the IT departments. The task of provisioning and deprovisioning

not it. AD FS does not provide features such as provisioning, mobile

applications for users should be simple and easily

app management or reporting. In addition, integration is manual

and does not support the 1,000s of applications that todays
companies are using.

accomplished. In addition, a group-based management system

should be implementable to allow for users to quickly gain access
to the broad set of applications they may need. If an employee

This whitepaper will discuss the hallmarks of a successful Active

were to switch roles within in an organization, it should also be

Directory integration and SSO deployment, and will compare

simple for the IT department to change their application access

Oktas comprehensive, 100% cloud based service to AD FS and its

seamlessly.

on-premises toolkit approach.

White paper

Active Directory Federation

Services as a SSO Solution
Enterprise Mobility Management

Microsoft Active Directory Federation Services (AD FS) is

intended to provide a platform for handling single sign-on with

Mobile might be the next thing that is going to propel your team
to new levels of productivity, but solving the security question is
holding you back. A good mobility management solution should
be fully integrated with your identity solution. Mobility

cloud applications outside of the firewall. This ostensibly allows

organizations to leverage AD FS to address the AD integration
component of SSO, but can only be considered a reasonable
solution for specific use cases.

management should be easy to configure, and allow you to

manage access by user, no matter the device or how many

When considering AD FS to address SSO needs, its imperative

devices they use.

to consider the platform. As a feature of Windows Server, AD FS

was developed to be a toolkitnot an end-to-end solution for

Logging and Reporting

single sign-on needs. Toolkits can be flexible, but they require

a significant amount of additional work to develop a complete

Many regulatory agencies (e.g. SOX, HIPAA) require audit trails for

solution. And thats work your IT team needs to perform.

users. This often includes seeing what employees have (or had)
access to. If an employee were to leave a company, IT departments

AD FS is a free solution, so why wouldnt all organizations use

would be required to provide details around

it? Several reasons: AD FSbased solutions require hardware and

software (there are three server roles that make up AD FS itself:

application access and de-provisioning. As usage increases by

two factors, number of users and number of applications,
aggregating this information becomes a difficult and daunting
task. SSO solutions should be able to gather usage information
for IT admins to quickly meet necessary company and industry
reporting requirements.

Active Directory Integration

the Federation Service, the Federation Service Proxy, and the

web server agent). AD FS also requires custom development and
maintenance, and administrative time to understand, configure, and
maintain the SSO connections with the target cloud applications.
When you factor in all these requirements, it becomes clear that a
solution based on AD FS is not actually free, nor is it scalable for a
large number of applications.
To configure AD FS you must obtain a valid SSL certificate (self-

Perhaps most importantly, an SSO solution must enable you to

continue to use your existing user store (Active Directory), and keep
all of your cloud applications synchronized with AD. The rest of this
paper focuses on this critical requirement, and compares Okta to
AD FS.

signed is sufficient for testing, but third-party signed is necessary

for production). Setup involves importing the SSL certificate,
exporting certificates, and creating shared certificates to establish
trust between your AD FS server and the target federation service.
When trust is established, you must then generate the claims rules
appropriate for authenticating with the target cloud application.
Claims rules can vary greatly based on the cloud application the
system is integrating with. Administrators must know the Uniform
Resource Identifier (URI) of the cloud application, which claims
the application requires, the URL the application should expose to
the user, and finally, whether the token should be encrypted. AD
FS provides a flexible rule engine that can handle most situations,
but you must not only define those rules for all integrations, but
you must also continuously maintain them as the target cloud
application changes.

White paper

Firewall

Internet

Your Network

On-Premise Apps

Active
Directory

Local Users
User
User Store
Store

Remote User s

Figure 1: AD FS requires integration for each individual cloud application, which is difficult and costly to maintain.
Searching blog posts, websites, and technical documentation to

Firewall

Firewall

discover the appropriate claims rules for each cloud application

Active
Directory

is time-consuming and unreliable. The rules for each application

may also change over time, invalidating your SSO integration, so

AF DS 2.0
Server

AF DS 2.0
Server

tracking those changes is necessary.

DMZ
AF DS 2.0
Server Proxy

AF DS 2.0
Server Proxy

Once you establish the AD FS infrastructure and develop the

appropriate claims rules for each target cloud application, its still
necessary to determine how users will actually use SSO to access

Enterprise
Internal User

these applications. Most likely you will have to either create a portal

Figure 2: AD FS architecture requires a minimum of two servers

where users can access these applications, or integrate access to

within the DMZ.

them into the existing corporate portal.

Clearly AD FS is a powerful platform that can be leveraged to

Additionally, there are significant hardware costs associated with

integrate AD with cloud applications. However, an organization

deploying AD FS. Microsoft requires a minimum of two servers

must commit considerable time and money to achieve and

to get up and running, a AD FS server and an AD FS Proxy Server.

maintain an end-to-end solution for all of their applications.

However, they recommend additional servers for high availability,

Even then, AD FS only addresses one-third of Active Directory

which increases the server count to at least four. If you wanted

integration challenges.

to connect a service like Office 365 via AD FS, a DirSync server is

Finally, AD FS does nothing to address one of the biggest shifts to

also required, upping the count to five serversjust to get up and

happen in computing and IT in several decades: the shift to mobile

running! On top of that, there are space considerations and utility

computing. Any SSO solution you consider must address mobility

and maintenance costs. Those last three costs dont go away in

for your end-users.

year two.

White paper

Okta: SSO for All Your Cloud,

Web and Mobile Applications
Okta is an integrated identity management and mobility

An integrated administrative experience that allows you to

management service designed to securely connect people to their

manage users, applications, and your AD integration from one

applications from any device, anywhere, at anytime.Built from

console, anywhere, anytime, and on multiple devices.

the ground up in the cloud, Okta is delivered with an unwavering

commitment to customer success.

A 100 percent on-demand offering. Oktas core service is a

multi-tenant solution with an AD agent that installs locally but

The Okta service provides:

without any appliances or servers to buy or maintain.

A complete end-to-end solution that requires no services to

install and includes:

Application integrations that are maintained for you. Okta

manages and updates the integrations so you never have to

Self-configurable, secure integration with your existing AD

worry about continued seamless integration as underlying

applications change.

infrastructure.
A large catalog of pre-integrated business and personal

Outbound AD connection over HTTPS. Oktas lightweight

agent makes a secure, outbound-only connection over

applications

HTTPSno firewall configuration changes are required.

A single sign-on home page for every user that offers oneclick access to all of their cloud applications.

Out-of-band authentication. Okta authenticates a user with

the cloud application and then gets out of the way. All ongoing
traffic is between the user and the application.

Internet

Firewall

Your Network

Okta IWA
Web App

Authenticate, Provision, De-Provision

Okta AD
Agent(s)

Active
Directory

On-Premise Apps

Local Users

Remote Users

Figure 3: Okta enables one integration point for all your current and future cloud applications.

White paper

The Hidden Costs of AD FS

While AD FS is marketed as a free platform, in practice, it is rarely

However, lets say you plan to add additional applications in the

free. In order to fully implement AD FS, IT departments must

future. Adding a new application via AD FS requires the same level

spend their time installing and configuring cloud applications.

of configuration, installation and maintenance as the original

While this may not seem like a large up-front cost, the number of

application. This additional work and costs can add up for IT

man-hours required for each new application does not decrease

departments, especially as companies adopt more and more cloud

with economies of scale. So if your company plans to scale from

applications.

one application today to five or six in the next three years, it means
your IT department will be configuring each new application. In
addition, all the manually configured applications via AD FS require
regular maintenance to ensure connectivity remains intact with

Year One

Year Two
Year One

corporate networks and infrastructure.

Year Two
Year One

Year Two

Year Three
Year Three
Year Three

Total
Total

Okta reduces installation and maintenance costs and downtime

Figure 5: AD FS costs can add up for integrating multiple

risks by maintaining the relationship with cloud applications.

applications.

Corporations need only to configure their networks with Okta

once and we do the rest. Okta continuously manages and monitors
cloud application integration to ensure you dont lose connection.

Total

If you were to compare the three-year costs of AD FS to Okta, you

would see be able to see that with each additional application,
costs to the company remain constant. Okta does all of the

In addition, Okta was developed with our customers in mind and

integration work; so little effort is required by IT departments to

is able to provide new updates to the product regularly with zero

configure new cloud applications to end-users. The cost for Okta

downtimeso youre always providing business critical application

never increases with new applications; therefore corporations will

access to employees.

see larger savings as they continue to add cloud applications to

Okta is also able to provide a central portal of applications to your

their infrastructure.

end-users. This enables them to easily access the applications

that have been provisioned to them. A similar solution via AD FS
would either need to be manually created in-house or outsourced
to another companyfurther increasing company costs. So you
could choose the free AD FS solution or you could choose Okta
and reduce your costs and while gaining additional functionality
beyond basic SSO.
Lets look at it another way. If you have one cloud application to
integrate with AD FS, the costs dont appear to be massive.

Application Setup
(Time) + Hardware
Costs

Year One

Application
Maintenance

Year Two

Year Three

Total

Figure 4: Relative AD FS costs for one application integration.

White paper

Okta versus AD FS Quick View Comparison

Metric

Okta Approach

Application
Integrations

ADFS Approach

1,000s of pre-integrated applications

IT Admins build and maintain each integration

No need to configure and maintain application

Only supports SAML, WS-*

integrations
SSO with any application, not just SAML or WS-Fed
apps
Availability

100% multi-tenant solution

Must configure, install and manage

Always-on with zero downtime

Required maintenance as applications evolve

No changes required to AD infrastructure

Availability redundancy
Requires multiple servers (installation & failover)

Access & User

Management

Control access to all your applications

Must create and manage custom AD attributes

Easily map different username formats

Every application may require changes

Easily add, change or remove users and access

No concept of user importing, matching

Import directly from AD, security groups

Automatically configured for all integrated
applications
Reporting

Dashboard of metrics to see overall health of users

N/A

and applications
Easy access to user reports for compliance purposes

Getting Started with Your

Free Trial

About Okta

To discover how easy it is to deploy Okta and to begin securely

and technology. By harnessing the power of the cloud, Okta

scaling your cloud-based applications, visit www.okta.com/freetrial

allows people to access applications on any device at any time,

to get started today.

while still enforcing strong security policies. It integrates directly

Okta is the foundation for secure connections between people

with an organizations existing directories and identity systems, as

well as 4,000+ applications. Because Okta runs on an integrated
platform, organizations can implement the service quickly at large
scale and low total cost. More than 2,500 customers, including
Adobe, Allergan, Chiquita, LinkedIn, MGM Resorts International and
Western Union, trust Okta to help their organizations work faster,
boost revenue and stay secure.
For more information, visit us at www.okta.com or follow us on
www.okta.com/blog.
6