We are thinking to move some of our intranet sites to public cloud.

Is there any way to keep using company SSO to authorize access to those sites from the company intranet?

  • just to be clear, you want these resources to be publicly accessible now?
    – neil
    Jan 28, 2012 at 0:47
  • basically 2 types of app. One is entirely intranet with no public access, another one has admin tools which should be availably only if user logs in from intranet Jan 28, 2012 at 23:39
  • 1
    so really it would all be in a closed off cloud. Take a look at EC2's Virtual Private Cloud. Easy setup, keep it locked down, VPN link between that and your office site, no reason you could keep using the same auth system you're using now.
    – neil
    Jan 29, 2012 at 0:16
  • Thanks! I guess I should have mentioned we are currently looking into PaaS kind of solutions. Like Heroku, for example. Probably we should include IaaS in the scope as well :). Jan 29, 2012 at 0:41

2 Answers 2


Sure it's possible. What you want to do is called Federation. How you set it up really depends on the applications and platforms you run though. There are a variety of protocols out there that can do what you want; e.g. SAML, WS-Federation, OpenAuth (to a degree), etc.

The applications need to be able to support the federation protocols though.

In theory you could also set up a VPN from the cloud provider to your intranet too.

If you are running an Active Directory domain you can use Active Directory Federation Services (v2) from Microsoft (http://msdn.microsoft.com/en-us/security/aa570351), and that will let you federate using SAML or WS-Fed to applications that support the protocol. If you are running another directory service there are a few other providers out there like PingFederate (https://www.pingidentity.com/). You could also use a product like (Full disclosure: I work for the company) AuthAnvil SSO (http://www.scorpionsoft.com/).

The questions you need to ask:

  • Do the applications support a federation protocol or do you need to set up a VPN?
  • Which option is more secure? This really should be threat modelled.
  • How do you lock it down so only intranet users can access it?
  • Do you allow users outside the intranet to access the application?
  • How do you protect the external endpoint if you do allow external users?
  • the applications are developed by internal IT, so I guess it won't be hard to tweak them to support the Federation. Thanks! Jan 28, 2012 at 23:43

SAML is a good approach if your cloud service provider support it. If not, you need to look for an sso solution that also support HTTP forms, which is how most providers authenticate users (user ID/password). Find out more at www.intel.com/go/identity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.