amanda-giannelli

Senior Software Engineer

Amanda Giannelli

Simplify logins, boost security, and enhance productivity with the power of Single Sign On!

## Introduction

Are you tired of juggling a bunch of usernames and passwords just to get your work done? You’re not alone. In today’s world, where we use so many different apps and services, keeping track of login details can feel like a full-time job. 

Enter Single Sign On (SSO), a simple yet powerful solution that lets you access all your apps with just one login. Let’s dive into what SSO is and why it’s such a game-changer for businesses.

## What is SSO?

You may have already used SSO without realizing it. Whenever you log into a website that leverages [identity providers](https://auth0.com/docs/authenticate/identity-providers) such as Google, Facebook, or Apple (to name a few), that is single sign-on in action.

SSO is a fancy term for a straightforward concept: log in once, and you’re good to go across all your apps. Whether it’s checking your email, collaborating on a project, or logging into your CRM with SSO, one login gets you everywhere you need to be. It’s like having an all-access pass to everything you need for work.

## How Does SSO Work? 

When SSO is enabled, and you attempt to authenticate to App A, you are sent to the authentication server to provide your credentials. Once authenticated, you are redirected back to App A and signed in. If you then access any other services (for example, another app) connected to the same auth server, you will be immediately authenticated into this application.

![SSO authentication and how it works](https://images.ctfassets.net/23aumh6u8s0i/1rHF8E9UCO7abbWzLRntV0/6856815f4ee9b078d83093d2a21a6bc7/typical-sso.png)

> Read more about [SSO authentication and how it works](https://auth0.com/blog/what-is-and-how-does-single-sign-on-work/). 

## Benefits of SSO

Now that you have a general understanding of what SSO is, let’s take a look at some of the benefits.

### Enhanced User Experience

Remembering a bunch of different passwords is a hassle. With SSO, you only need to remember one password. No more struggling to recall if your password for App A has a special character or if App B requires an uppercase letter. Log in once, and you’re in — it’s that simple.

#### Goodbye, Password Overload

Keeping track of passwords can feel overwhelming. While a password manager is an option, SSO puts an end to needing scores of passwords. By reducing the number of passwords you have to remember, it’s less likely you’ll get locked out or end up using the same password everywhere (which, let’s be honest, [isn’t very safe](https://www.security.org/resources/online-password-strategies/)).

#### Get to Work Faster

SSO saves you time. Instead of typing in different credentials every time you switch apps, SSO gives you instant access. It’s like walking through an open door instead of fumbling for keys — you get to work faster and with less hassle.

SSO providers also typically provide a dashboard with all of the apps you have access to. Open the dashboard, select your app, and you’re in. 

### Boost Security

You might think that having one login for everything sounds risky, but SSO actually makes your business more secure. Here’s how:

#### One Secure Login Point

With SSO, all your logins are managed in one place. This means your IT team can keep a close eye on things and quickly respond if something looks suspicious. It’s like having all your valuables in one safe instead of scattered around the house.

#### Reduced Chance of Phishing 

[Phishing scams](https://auth0.com/blog/protecting-against-phishing-attacks/) — fake emails trying to steal your info — are a big problem. But with SSO, you’re not entering your password over and over, so you’re less likely to fall for a phishing trap. Fewer logins mean fewer chances for scammers to trick you.

#### Add Extra Security with MFA

Most SSO solutions let you add [Multi-Factor Authentication](https://auth0.com/docs/secure/multi-factor-authentication) (MFA), which provides another layer of security by requiring more than just a password to log in. Maybe you’ll need to enter a code sent to your phone or scan your fingerprint. This extra step makes it much harder for hackers to get in, even if they have your password.

### Lighten the Load on Your IT Team

SSO isn’t just great for users. It's also a lifesaver for your IT department. Managing user accounts and passwords can be a real headache, but SSO makes it a breeze.

#### Easier User Management

With SSO, your IT team can manage who has access to what from a single dashboard. Need to give new employees access to all the tools they need? Done in a few clicks. Need to remove access when someone leaves? Just as easy. It’s all centralized, which saves time and reduces errors.

#### Fewer Helpdesk Calls

Did you know that [up to 50% of helpdesk calls](https://agio.com/your-employees-are-wasting-30-of-their-time-resetting-passwords/) are for password resets? SSO cuts down on the need to [reset your password](https://auth0.com/learn/password-reset), freeing up your IT team to focus on bigger issues and your employees to work on what truly matters. Less time resetting passwords means more time to solve real problems.

#### Smooth Compliance and Reporting

If your business is in a regulated industry (such as finance or healthcare), SSO can make compliance a lot easier. It keeps detailed logs of who accessed what and when, so when it’s time for an audit, you’ve got everything you need at your fingertips.

### Scale Up with Ease

As your business grows, so do your tech needs. The good news? SSO grows with you. Whether you’re adding new apps or expanding your team, SSO makes it easy to scale up.

#### Integrates with What You Already Have

SSO solutions are designed to work with the tools you’re already using, whether they’re in the cloud, on your servers, or a mix of both. So, no need to overhaul your entire system — just plug SSO in and keep moving forward.

#### Works Across All Environments

Many businesses today use a mix of on-premises and cloud-based applications. SSO bridges the gap, providing a seamless login experience across all platforms. So, as you move more of your operations to the cloud, SSO keeps everything running smoothly.

#### Future-Proof Your Business

By implementing SSO, you’re setting your business up for success as you grow. No matter how many new apps or services you add, SSO will be there to keep everything secure and accessible, ensuring your team can stay productive without getting bogged down by tech hurdles.

### Better Collaboration with Partners

If your business works with external partners or clients, SSO can make those relationships smoother and more secure. Here’s how:

#### Secure Partner Access

SSO lets you extend secure access to your partners without compromising your internal security. You control who sees what, so everyone has the access they need — and nothing more.

#### Easier Collaboration

When your partners can log in easily without juggling multiple credentials, it’s easier to work together. Whether you’re sharing documents or managing a project, SSO makes collaboration a breeze.

### Challenges

For all of its amazing benefits, SSO is not without its challenges. Understanding these considerations can help you plan effectively and ensure that your SSO implementation is successful. Here are a few to keep in mind:

#### Single Point of Failure

SSO centralizes authentication, so if the SSO system goes down, users may lose access to all connected applications. This is why high availability coupled with redundancy for your SSO solution is critical to reduce downtime. High availability means the system is always on and available no matter what happens. Redundancy enables high availability by acting as a backup plan in the event of failure to ensure the services remain functional. 

#### Setup and Integration

Integrating SSO into existing applications can be complex and time consuming, especially when dealing with a mix of legacy and new systems. Careful planning and coordination between IT teams and application owners is crucial to ensure a smooth implementation.

#### Security Risks

While SSO can enhance security, it can pose a risk if not properly managed. If an attacker gains access to a user’s SSO credentials, they could potentially access multiple applications. Implementing strong authentication methods, such as MFA, is essential to mitigate this risk. 

#### User Adoption and Training

Users need to be educated on how SSO works and the importance of keeping their credentials secure. Without proper training, there may be confusion or resistance — especially in less tech-savvy organizations. 

## Conclusion

SSO isn’t just a buzzword. It’s a powerful tool that can make your business more efficient, secure, and scalable. By simplifying the login process, reducing security risks, and lightening the load on your IT team, SSO can help your business thrive in today’s fast-paced digital world.

If you’re not using SSO yet, now’s the perfect time to start. Whether you’re a small business looking to grow or an established company ready to streamline operations, SSO can give you the boost you need to stay ahead of the curve.

Benefits of Single Sign-On (SSO)

Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Before you start working with AI developer tools, understand what it could mean for you, your product, and your customers.

<div class="alert alert-info alert-icon">
 
 Note: 
 This blog post is based on interviews conducted with startup founders, engineering managers, data scientists, and risk analysts in the Artificial Intelligence and Machine Learning space. 
</div>

Evaluating tools that can help optimize your development processes? Maybe you’re entirely building alongside [Devin, the first AI software engineer](https://www.cognition-labs.com/introducing-devin) to get your app to market faster, generating code snippets for your React app with [V0.dev](https://vercel.com/blog/announcing-v0-generative-ui), or using [GitHub CoPilot](https://thehackernews.com/2024/03/github-launches-ai-powered-autofix-tool.html) to help patch your website’s security flaws.

While productivity and efficiency are hallmarks of development success, security and privacy are just as paramount to protect your product and maintain customer trust. According to [Snyk’s 2023 AI Code Security report](https://snyk.io/reports/ai-code-security/), **80% of developers are bypassing security policies to use AI**.

But modern-day [Generative AI](https://news.mit.edu/2023/explained-generative-ai-1109) tools don’t typically have the built-in capability to determine whether the data it is exposed to is sensitive. It’s completely up to the user to take precautions and set up the proper protocols when choosing to use one of these tools. Let’s explore the potential risks of using AI tools in the dev process and what questions you could ask yourself to help make more informed decisions – for you, your product, and your customers.

## Productivity vs. Risk

According to Snyk’s blog, [How to Embed Security in AI-assisted software development](https://snyk.io/blog/snyk-and-atlassian-embed-security-ai-assisted-software-development/), “Code generation, using generative AI… is the area that stands to offer the greatest productivity benefits — **and the highest potential for introducing risk**.“

AI tools can help accelerate the process of taking an idea and building an MVP with limited resources. Although engineering productivity cannot be tracked by a single metric for all, it’s easy to see how these tools are already helping developers reduce time spent in generating code and improving the quality of code.

Like with all third-party tools, to strike the perfect balance between productivity and risk, it’s important to recognize ways in which these tools can hurt your product and customer security, now and in the future. In many situations, risk cannot be quantified, but companies can have an increased or decreased risk factor (risk tolerance) depending on:

* Industry
* Product type and use case
* Company stage

For example, risk tolerance can be higher for startups in growth mode, especially in industries outside of security.

## Risk Prevention Strategies

Let’s explore the most common risks associated with AI tools and mitigation strategies outlined by some engineers. 

Nonprofit OWASP (The Open Worldwide Application Security Project) documented a [list of potential security risks](https://owasp.org/www-project-top-10-for-large-language-model-applications/) when deploying and managing Large Language Models (LLMs) – some examples include:

* Sensitive Information Disclosure (LLM06) - LLMs can inadvertently disclose sensitive, proprietary, or confidential information leading to privacy breaches, intellectual property theft, and unauthorized access
* Prompt Injection (LLM01) - Attackers can manipulate LLMs through crafted inputs, causing the LLMs to execute the attacker’s intentions
* Overreliance (LLM09) - Systems or people overly dependent on LLMs without oversight may face misinformation, miscommunication, legal issues, and security vulnerabilities due to incorrect or inappropriate content generated by LLMs

When adding these tools to your tech stack, do these questions come to mind?

* How are you deciding which tools to use to increase your efficiency and productivity? 
* Do you have an internal vetting process for third-party vendors? How are you updating this for AI tools?
* Will you be prompting the AI tools with customer data and PII or proprietary restricted information? Are you in line with your applicable regulatory compliance frameworks? (GDPR, etc.)
* Does this tool abide by your corporate guidance?
* Do you have customer permission to use their data in this way?
* How could these tools impact you?
* What risks will you, your product, and your customers face?
* What guidance or guardrails does the tool have to protect your data as a user? Two popular types of AI developer tools are those for engineering productivity and those for general use, and the available configurations may vary.

We interviewed a few engineers (anonymously) about what they’re doing to minimize the risks associated with AI developer tools. Here’s a breakdown of some of the most common concerns and questions engineers are asking to reduce any harmful and inadvertent impact while coding with Gen AI tools.

* PI and copyright concerns
 * Once one of these tools generates code, who is the owner?
 * What happens if the tool is suggesting the same code to another customer, maybe even a competitor?
 * If you use AI tools in order to create a customer-facing chatbot, and a customer includes PII in their prompt – who is in charge of monitoring and removing this data and ensuring it isn’t being used to re-train models?
* Overreliance
 * Generating a few lines of code vs a few files of code – how familiar are you with the code in your product, and how much do you trust it?
 * Are you aware of the potential risk of [AI hallucinations](https://www.ibm.com/topics/ai-hallucinations) and how are you reducing it?
 * AI hallucinations are outputs from models that are nonsensical or inaccurate. For example:
 Question: where can I find the help center?
 Context: you’re looking for a website like [domain].com/help or support.[domain].com
 AI answer: the help center is located on the ground floor of this building.
* How are you updating your code and content review processes to deal with Gen AI?
* Data Exposure
 * Can you make sure your own data won't be used to answer prompts for competitors or malicious actors?
 * What are practical and technical strategies you can take to prevent data exposure?
 * Do you have strict policies and training for engineers when they are using these tools, or are you exploring third-party tools that tackle data leak prevention?

There’s no specific path to being completely secure from the risk of AI tools today, but there are many different strategies you can take to build strong guardrails to protect code and mitigate risk. Ensuring restrictions are very specific when engineers are using AI tools like Devin and code review is a must.

## AI Developer Tools Now and Tomorrow

AI tools for developer productivity are becoming increasingly popular. Further down the line, a startup founder might be able to ideate, possibly write [pseudocode](https://builtin.com/data-science/pseudocode), and use these tools to bring their idea to life. They might be able to start testing in a matter of minutes, not months.

If you’re an early-stage company, you might be eager to get started and may not have as much internal guidance as a large corporation. We hope this blog helps you start to outline the potential risks and considerations when evaluating AI tools for developer productivity. 

[Auth0 for Startups](https://auth0.com/startups) is empowering early-stage startups – tell us what we can do to best support you and your team!

_These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments or all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at [okta.com/agreements](http://okta.com/agreements)._

Security Considerations in the Time of AI Engineering

leonardo

Leonardo is a Senior Software Architect at Okta, working on the new Auth0 platform and cutting-edge product features. He is a seasoned technical leader with 17 years of experience in a wide range of segments, from enterprise to SaaS systems. As an Apache committer, he has contributed to various open-source projects. He is a self-learner, passionate about new technology, and has spoken at several developer events.

Senior Software Architect

Leonardo Zanivan

Replatforming to enhance agility, productivity, scalability, reliability, and security.

**TL;DR:** Auth0’s private and public cloud offerings are converging on a single platform to deliver an increase in business agility, developer productivity, scalability, reliability, and security for our customers and Auth0 by using industry-leading tools and fully automated operations.

Initially, Auth0 evolved our public and private cloud offerings as separate platforms because we could go fast and innovate on the public cloud and then work through the greater performance, compliance, and control expected by our private cloud customers. But over time, this led to feature discrepancies and, frankly, just wasn’t that efficient to maintain, scale, or innovate.

So we began an ambitious replatforming project. How could we re-architect all of Auth0 into a single platform? Could we support deployments on both Amazon Web Services (AWS) and Microsoft Azure? What about increasing geo-failover options? And we needed to continue our 99.99% SLA across both public and private clouds.

Let’s not forget that private cloud customers may also require extra add-ons like data residency, private links, and dedicated performance. This post will walk you through our approach to rearchitecting Auth0 to address those challenges.

## The Convergence Starting Point

While both platforms worked exclusively on AWS cloud, the private cloud was not using cloud-native solutions. It had three tiers — Basic, Perf, and Perf+ — available as environment sizes. These were selected based on the number of users and requests per second, versus an elastic scalable public cloud environment shared by multiple customers. The main difference is that private deployment usefully isolated and dedicated resources in any region. In comparison, public deployment uses shared resources for multiple customers in specific regions (United States, Europe, Japan, and Australia).

Our public cloud saw new features delivered on a weekly basis, but due to limited automation, our private cloud required high-touch operations for upgrading to new releases that rolled out on a bi-weekly cadence. 

Requirements for private cloud deployments set it up as a superset of the public cloud offering that already guarantees a 99.99% SLA, with a track record of 99.99+% over the last three years. This was across three availability zones and a geo-failover for regional redundancy and availability.

But we knew we also wanted to include extra add-ons like private links, [PCI compliance](), and meet the customer requests for [Azure Cloud]() support.

## New Cloud-Native Architecture

On a high level, the new cloud-native architecture delivers an increase in business agility, developer productivity, scalability, reliability, and security for our customers and Auth0 by using industry-leading tools and fully automated operations.

It closes the gap between Auth0 public and private deployments by packaging all the product features in a single software version and making them available depending on the customer subscription and add-ons. 

The ideation for the new platform is based on the following premises:

* **Multi-cloud: **AWS and Azure cloud support through a common interface
* **Container orchestrated:** use of container images instead of installing packages
* **Stateless**: scalable and replaceable by design
* **Immutable**: run only trusted code and configuration
* **Fully automated:** provisioning, upgrades, and decommissioning are done by machines
* **GitOps:** enhanced DevOps, push code and safely reproduce it thousands of times  

This removes the worry about the underlying infrastructure, allowing Auth0 developers to place their focus on our customers. This can be represented by the layers in the box below:

![Aplication Layer](https://images.ctfassets.net/23aumh6u8s0i/3yX9TOMT8XC0UPPKK6N57h/41dbdb93833d8c2e20e7c2be1bb445ef/88133_Private_Cloud_Campaign_Auth0.png)

* **Infrastructure layer**: It builds the infrastructure using AWS and Azure cloud services such as networking, virtual machines, key management, load balancers, container repositories, Kubernetes, and managed datastores (Mongo, PostgreSQL, Redis, Kafka).
* **Interface layer**: [Terraform](https://www.terraform.io/) is used for bootstrapping the infrastructure using code on different clouds. [Vault](https://www.vaultproject.io/) is used for platform secrets management and [Kubernetes](https://kubernetes.io/) as de-facto technology for application runtime along with custom plugins to describe services manifest, configuration, and secrets using the platform control plane component. [Argo CD](https://argoproj.github.io/cd/) is a GitOps continuous delivery tool used for applying for new software releases while [Argo Workflows](https://argoproj.github.io/workflows) is used for orchestrating the provisioning, upgrades, and decommissioning steps. This layer also contains integrations and agents for managing service discovery/DNS, logs, metrics, security audit, and datastores.
* **Application layer**: It is where the containers run. The Auth0 Identity Platform is built to allow multiple stacks with different sets of containers deployed accordingly to their usage. Auth0 products, PoP, Control Plane, and Central Services use a promotion pipeline for validating new releases and configurable release schedules. Everything is managed by control plane API and developers interact with the new platform CLI or Hub (web interface). One might wonder how identity is managed to access Kubernetes resources, it uses [Pomerium with Auth0 Identity Provider](https://www.pomerium.com/docs/identity-providers/auth0.html), dogfooding our own product.

Before we go deep into the technical details, the blog [A Primer on the New Private Cloud Platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) provides more details about the Space, PoP, Control Plane and Central components of the new platform.

## The Components—A Ten Thousand Foot View

The diagram below demonstrates the main components of the platform and its links, including data flows and cloud regions. Internal services and network details are omitted.

![The Components—A Ten Thousand Foot View](https://images.ctfassets.net/23aumh6u8s0i/2bmBmIoidTViCeyw2dInNB/26a1c8a5cd9ac8a556488585edbb35d4/Arquitecture.png)

**Edge Network**: The global network provider, used by Auth0 for DNS, edge computing, CDN, DDoS protection, web application firewall, custom domain certificates, and speed-up end-user experience.

**Space**: Customer environment containing the dedicated application and datastores resources, deployed in any cloud region, maintaining security and data residency through tight access control for operators. Datastores use dedicated private networks isolated from the applications. New application deployments spin a whole new application cluster containing the new version and then slowly switch the traffic using a 'canary deployment' strategy. In addition to that, 'Data Shield' component is responsible for receiving a variety of data such as application logs and then scrubbing it, removing any PII or sensitive information. Only the clean logs are ingested and clean data is forwarded to Auth0 data analytics and detection & response teams for monitoring the system. The customer data never leaves the cloud region (e.g. Azure EastUS).

**PoP**: Point of presence of the platform in a given cloud region (same as the Space), required to host the container registry of software stacks used by the Kubernetes cluster. This component runs a set of shared services to support the platform, including the OpenSearch stack used by operation engineers to troubleshoot issues. It also runs regional services, shared between Spaces to support platform operations, such as forwarding data analytics, and internal Auth0 system supporting services requiring low network latency for fulfilling requests. It is important to note though that PoP doesn't have access to the Spaces network, it acts as a regional endpoint.

**Central & Control Plane**: A region in the European Union (EU) where the control plane services are deployed. They are internal to Auth0 operators and are used to interact with the customer Spaces and PoPs. It is secured by Zero Trust model and manages platform secrets and metadata using Terraform, Vault, and Argo. In addition to the control plane services, the central component is also designed to run other completely isolated application stacks to host global services accessible by customers and support engineers.

**Auth0**: The analytics aggregated data is sent to Auth0 headquarters and other global systems such as DataDog and Snowflake to be consumed by internal teams in many different departments, such as business analytics, customer support, and engineering teams. The data is categorized into different levels of access and doesn't identify any customer-sensitive information such as personally identifiable information (PII). The Detection & Response team is an exception and runs security software to analyze production traffic and usage patterns to actively detect & mitigate attacks.

## High Availability and Geo-failover

Auth0 guarantees a 99.99% SLA for production deployments. On a high level, the infrastructure is fully redundant, and all components are deployed into multiple availability zones, using at least 3 availability zones (AZ) combined primary and secondary regions, either in clustered mode or standby replicas. 

For web applications, the traffic is distributed across multiple Kubernetes nodes using load balancing. For datastores, Mongo and PostgreSQL are considered the system of record, i.e. the authoritative source of data, deployed in the primary region with a writer and at least a reader node for splitting write/read traffic and replicating the data to a secondary (failover) region in real-time. The caching (Redis) and stream (Kafka) components are deployed using sharding and failover capabilities, always providing high availability for runtime and data.

As for central services, control plane, and PoPs, they also run on high availability infrastructure and have the ability to failover, while this process is executing or in case of temporary or permanent network connectivity issues, the Spaces continue functioning as expected without any disruption. Spaces are isolated from each other and are fault-tolerant to other tiers' failures. 

The geo-failover is a fully automated process and is manually triggered by an operator during incident response for disaster recovery in case a cloud region is fully or partially unavailable. The process redirects all the traffic to the secondary region (determined by the customer) which switches the DNS of the cluster ingress and promotes the secondary region replicas to become the primary writer; there's no dependency on the primary region for the disaster recovery to successfully execute. 

The target RPO (Recovery Point Objective) is less than a minute, the time period in which data and events can be lost due to the disaster recovery procedure. At the same time, the RTO (Recovery Time Objective) is less than 15 minutes for the amount of downtime tolerated during the disaster recovery process.

The process of failback (revert the failover) from the secondary to the primary region is the same and can be triggered once the situation resolves.

The diagram below shows the Auth0 deployment containing a primary and a secondary warm standby region with high available datastores, and for simplifying purposes other AZs running only applications are omitted:

![Azure servers](https://images.ctfassets.net/23aumh6u8s0i/7f96vQ2UJukSjYJYc5flNt/a406ca7bac6ad54dc5e2bfc75c754dd8/Azure_servers.png)

We are publishing a series of technical posts on how and why we replatformed. They’ll be linked at the bottom of this post as they publish and are also findable on our blog. If you have technical questions or ideas for future posts, please reach out to us via the [Auth0 Community](https://community.auth0.com/). (Our marketing team also tells us we would be remiss if we didn’t include a link to talk to Sales so that is [here](https://auth0.com/contact-us), too.)

The Architect’s View of Auth0’s New Private Cloud Platform

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Developer input on purchasing decisions critical for productivity and satisfaction

**BELLEVUE, Wash. – Oct. 21, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced the results of a global survey entitled, "[How Development Teams Purchase SaaS](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas)," sponsored in partnership with Bessemer Venture Partners(1). This digital research survey, operated by SD Times—encompassing respondents from a range of company sizes, industries, regions, and roles within an application development team—revealed two trends: Companies that implement more SaaS components innovate faster than those that don't, and those that do innovate faster are relying more heavily on developer teams for input in SaaS purchasing decisions. 

Building software has become a necessity for companies to stay competitive in today's highly cloud-dominated market. SaaS components like authentication, monitoring, and payment processing provide invaluable building blocks to development teams, enabling them to build applications faster and smarter. The survey findings show a correlation between using SaaS components and speed and frequency of releasing new services, including:

* More than half of survey respondents (51%) who released new features once a month or faster used SaaS components in more than half of their applications. 
* 80% of respondents who released new features more slowly (between 1-12 months) do not use SaaS components in the majority of their applications.
* Using SaaS components for 'time savings and agility' was cited as the number one reason why they are implemented (76%), followed by 'features and functionality,' and 'utilizing technical expertise.' 

There is still tremendous market opportunity for SaaS component integration that remains untapped, and 58% of respondents say their companies will increase investment in third-party SaaS services over the next year. The application components cited as being the most burdensome to build in-house were: 1) Payment processing; 2) Authentication; 3) Data Management and Storage. Implementing SaaS components for each function are well worth the investment. Of the respondents that use a SaaS platform for authentication, 83% cited a reduction in time-to-market. 

"As early investors in the category, we've been stunned by the massive growth of cloud computing this year, especially during these challenging times," said Ethan Kurzweil, partner at Bessemer Venture Partners. "2020 provided evidence that the cloud is the underlying foundation to digital operations and delivery of software. Now more than ever, enterprises across the globe need to integrate SaaS components to save time, cost and deliver on product innovation. Auth0's survey underscores the value and role developer platforms play in driving the speed and value of software development."

The way in which SaaS components get selected was also an overriding theme of the survey, revealing that developers care greatly about being consulted in SaaS component purchase decisions. The survey also found resounding results around the way in which these companies are integrating development teams' feedback into their SaaS purchasing decisions. Having a say in which SaaS components are selected matters to 91% of developers and results in a vast majority citing overall job satisfaction (88%) and increased productivity (87%).

"The purchasing power [of SaaS components] isn't held exclusively by the executive team at Toast, but rather it's a collaborative effort between the development team's recommendation and the business's requirements," said Chance Kirsch, staff software engineer at Toast. 

"Auth0 was founded on the idea of empowering developers so they can focus on innovation that matters for their customers. This survey only amplifies that belief, and it's fantastic to see their increasingly influential role at their companies when making important business-driving decisions," said Shiven Ramji, Chief Product Officer at Auth0. "This survey reinforces the power that SaaS components have on overall productivity and team collaboration. We are still in the early days of adoption, and services like authentication will continue to see increases in adoption, especially as the use of SaaS components becomes ubiquitous."

Operated by SD Times, this was a blind online survey to a global audience of 352 respondents, 64% from North America, 20% from EMEA, 15% from APAC, and 1% from South America. For more detailed information, please visit Auth0's Resources page to download the full "[How Development Teams Purchase SaaS](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas)" survey results. 

(1): Bessemer Venture Partners is an investor of Auth0. 

<include src="asides/AboutAuth0" />

### Media Contacts:
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Companies That Use SaaS Components Innovate and Launch Products Faster, According to Auth0 Survey

brecht-de-rooms

Brecht De Rooms is developer advocate at Fauna. He is a programmer who has worked extensively in IT as a full-stack developer and researcher in both the startup and IT consultancy worlds. It is his mission to shed light on emerging and powerful technologies that make it easier for developers to build apps and services that will captivate users.

Developer Advocate at Fauna

Brecht De Rooms

In this article, we take a deep look at how databases that behave like APIs increase developer productivity.

What Is Fauna, and How Does It Work With Auth0?

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Project Amber incubates smaller, productivity-oriented Java language features that have been accepted as candidate JEPs. Take a quick glimpse of the features that will arrive on the platform soon.

Recently, [Java changed its release cycle to a more rapidly cadence](https://www.forbes.com/sites/oracle/2018/03/20/what-java-10-and-javas-new-6-month-release-cadence-mean-for-developers/#7ed00d4a271a), affecting the way the language evolves overtime. With this new cadence, features can now reach the market faster. Besides that, this cadence enables the community to work on (and deliver) smaller features instead of expending all their energy on the big changes (e.g., lambda, generics, and modules).

Throughout the next sections, you will learn about Amber, the project that incubates small, productivity-oriented Java language features.

<include src="TweetQuote" quoteText="Stay on top of Project Amber and learn what productivity-oriented @java language features will arrive soon."/>

## Project Amber

Project Amber, [as explained on its homepage](https://openjdk.java.net/projects/amber/), is an effort focused on "exploring and incubating smaller, productivity-oriented Java language features that have been accepted as candidate JEPs under [the OpenJDK JEP process](https://openjdk.java.net/jeps/1)." At the time of writing, this project has already delivered two enhancements and is planning on delivering five more. Let's learn about these enhancements.

> Not sure what JEP (JDK Enhancement Proposal) means? Check out this article and [learn more about the Java platform and the community process that is responsible for evolving it](https://auth0.com/blog/java-platform-and-java-community-process-overview/).

### Enhancements delivered

The first enhancement already released, called [_Local-Variable Type Inference_](https://openjdk.java.net/jeps/286), was introduced in Java 10 and allows developers to reduce the ceremony associated with writing Java code while maintaining Java's commitment to static type safety. With this enhancement, developers can now declare variables like this:

```java
var list = new ArrayList<String>(); // infers ArrayList<String>
var stream = list.stream(); // infers Stream<String>
```

```java
List<String> list = new ArrayList<String>();
Stream<String> stream = list.stream();
```

The second enhancement, called [_Local-Variable Syntax for Lambda Parameters_](https://openjdk.java.net/jeps/323), was introduced in Java 11 and extends the _Local-Variable Type Inference_ feature by allowing `var` to be used when declaring the formal parameters of implicitly typed lambda expressions. For example, with this enhancement, if you write the following code:

```java
IntStream.of(1, 2, 3, 5, 6, 7)
 .filter((var i) -> i % 3 == 0)
 .forEach(System.out::println);
```

Java will have no problem identifying that the `i` variable is an integer.

### Enhancements being developed

Besides the enhancements already released, Project Amber is planning on delivering _Lambda Leftovers_, _Pattern Matching_, _Switch Expressions_, _Raw String Literals_, and _Concise Method Bodies_.

#### **Lambda Leftovers**

The [_Lambda Leftovers_ enhancement](http://openjdk.java.net/jeps/302) aims at bringing two new features to the Java language. First, this enhancement will allow developers to use an underscore (_) to denote an unnamed lambda parameter. Second, the enhancement will allow lambda parameters to shadow variables already defined in the enclosing context. For example, this last feature will enable developers to write code as follows:

```java
Map<String, Integer> msi = ...

String key = computeSomeKey();
msi.computeIfAbsent(key, key -> key.length());
```

In this case, the inner `key` variable will cause no conflict with the external one (derived from the `computeSomeKey()` call).

#### **Pattern Matching**

The [_Pattern Matching_ enhancement](https://openjdk.java.net/jeps/305) will allow developers to be more concise when dealing with the `instanceof` operator. For example, with this feature, whenever developers want to check if an object is a `String` and use it as such, instead of doing this:

```java
if (obj instanceof String) {
 String s = (String) obj;
 // use s
}
```

They will be able to do this:

```java
if (obj instanceof String s) {
 // can use s here
}
```

By using the new pattern matching feature, developers will reduce the overall number of explicit casts in Java programs considerably. For example, as type test patterns are particularly useful when writing equality methods, instead of having a method like this:

```java
@Override public boolean equals(Object o) { 
 return (o instanceof CaseInsensitiveString) && 
 ((CaseInsensitiveString) o).s.equalsIgnoreCase(s); 
}
```

Developers will be able to simplify the code (and avoid the explicit cast), as shown here:

```java
@Override public boolean equals(Object o) { 
 return (o instanceof CaseInsensitiveString cis) && 
 cis.s.equalsIgnoreCase(s); 
}
```

#### **Switch Expressions**

The [_Switch Expressions_ enhancement](https://openjdk.java.net/jeps/325) will enable developers to use the `switch` feature as either a statement (the _traditional_ way) or as an expression (the _simplified_ version). This change will simplify some code, as you can see on the following code snippets. The first one shows how you would use the traditional `switch` keyword to make a decision:

```java
switch (day) {
 case MONDAY:
 case FRIDAY:
 case SUNDAY:
 System.out.println(6);
 break;
 case TUESDAY:
 System.out.println(7);
 break;
 case THURSDAY:
 case SATURDAY:
 System.out.println(8);
 break;
 case WEDNESDAY:
 System.out.println(9);
 break;
}
```

The second one shows how you would use the simplified version to achieve the same result:

```java
switch (day) {
 case MONDAY, FRIDAY, SUNDAY -> System.out.println(6);
 case TUESDAY -> System.out.println(7);
 case THURSDAY, SATURDAY -> System.out.println(8);
 case WEDNESDAY -> System.out.println(9);
}
```

Pretty nice, huh?

<include src="TweetQuote" quoteText="The new Switch Expressions proposal will allow @java developers to use switch as expressions to write more concise code."/>

#### **Raw String Literals**

The [_Raw String Literals_](https://openjdk.java.net/jeps/326) enhancement will add, as the name states, raw string literals to the Java programming language. This type of string can span multiple lines of source code and does not interpret escape sequences, such as `\n`, or Unicode escapes, of the form `\uXXXX`. Among its goals, the enhancement plans on:

- make it easier for developers to express sequences of characters in a readable form, free of Java indicators;
- supply strings targeted for grammars other than Java;
- and supply strings that span several lines of source without supplying special indicators for new lines.

One good way to see the benefits of this enhancement is to consider what you would need to do to write a long SQL query:

```text
String query = "SELECT `EMP_ID`, `LAST_NAME` FROM `EMPLOYEE_TB` " +
 "WHERE `CITY` = ‘INDIANAPOLIS' " +
 "ORDER BY `EMP_ID`, `LAST_NAME`;";
```

By using _Raw String Literals_ you will be able to rewrite the previous code snippet as follows:

```text
String query = ``SELECT `EMP_ID`, `LAST_NAME` FROM `EMPLOYEE_TB`
 WHERE `CITY` = ‘INDIANAPOLIS'
 ORDER BY `EMP_ID`, `LAST_NAME`;
 ``;
```

#### **Concise Method Bodies**

The [_Concise Method Bodies_](https://openjdk.java.net/jeps/8209434) enhancement is all about supporting _more_ concise methods in the Java programming language. The Java 8 version, released back in 2014, introduced what is known as the [_Lambda Expressions_](https://jcp.org/en/jsr/detail?id=335) enhancement. This enhancement, known as Java's first step into functional programming, allowed developers to define methods that do not belong to any class. As such, these methods (which have a very concise syntax) can be passed around as if they were objects and can be executed on demand.

For example, prior to the Lambda Expressions introduction, if you needed to do some calculation and return an integer, you would have to find a class where to define a new method:

```java
public static class Utils {
 public static int calculate(Object someParameter) {
 // ... calculate
 return result;
 }
}
```

After that, you would be able to call this method whenever you wanted, after importing the `Util` class. With the introduction of this new feature, you can now replace all this boilerplate with something much simpler:

```java
ToIntFunction<Object> calculate = (Object o) -> {
 // ... calculate
 return result;
};
```

The code above, instead of belonging to some random class (like `Utils`, on the example), can be written and called right where you need it. This can be considered the first _concise methods_ introduced in the programming language.

Now, back to the _Concise Method Bodies_ enhancement that Project Amber will introduce, when this feature is released, developers will be able to apply this kind of syntax in more places. For example, if you ever did something like creating a method like this:

```java
int length(String s) {
 return s.length();
}
```

In the near future, you will be able to rewrite it like this:

```java
int length(String s) -> s.length();
```

## Conclusion

As you learned in this short blog post, Project Amber is the project that you have to keep an eye on to learn about the productivity-oriented features that will arrive at the Java programming language soon. If you want to stay on top of this, [follow us on Twitter](https://twitter.com/auth0), or subscribe to our newsletter.

<include src="asides/AboutAuth0" />

The Future of Java - Project Amber

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

A new password manager and improved UX lead to quick, safer search.

With updates every six weeks, Google is constantly improving their Chrome browser. But for its ten-year anniversary, Google wanted to give their users a special reason to celebrate. And they delivered with their most recent Chrome update. 

![New UI and features of Google Chrome browser](https://images.ctfassets.net/23aumh6u8s0i/vDmVepxBP7oYXs1FyrsvS/67526580ff6011181a887216df198fbe/google-chrome-a-new-look)

Perhaps you've already peeked at the changes (it launched in early September). But with all of the new details it packs in, even the most up-to-date teams might not have dug in far enough. While some of the updates are undetectable, there are a few more prominent ones that teams using Chrome should understand and employ.

This is a first indication of what is to come in search updates from the giants over at Google. For teams looking to increase productivity — and especially security — we've saved you the trouble of sifting through the details on your own.

<include src="TweetQuote" quoteText="Google is releasing a new Chrome that will improve employee security and productivity."/>

## Chrome's New Password Manager Reduces Chances of Hacking

With a freshly re-imagined password manager, this Chrome update has made it easier for employees to avoid password recycling and improve password storage. This is more important than you might think. According to a recent study, poor passwords are responsible for [81 percent of data breaches](https://www.myndnow.com/news/bismarck-news/poor-passwords-responsible-for-81-of-company-data-breaches/1344822736). Over 70 percent of employees reuse the same password on multiple sites at work — and many of these recycled passwords are easy to hack in the first place. 

Some easily-detectable employee password examples include:

* 123456
* qwerty
* password
* abc123

(The above data is from [Troy Hunt's sample](https://www.troyhunt.com/86-of-passwords-are-terrible-and-other-statistics/) of more than half a billion passwords that were previously implicated in data breaches.)

The [2012 Dropbox data breach](https://techcrunch.com/2016/08/30/dropbox-employees-password-reuse-led-to-theft-of-60m-user-credentials/), which took the company four years to discover, resulted in the theft of 60 million user credentials due to one employee reusing a password.

Convinced that well-crafted passwords are important? Google agrees.

It has evolved its password-saving function (for easier log-ins and payments) to include a unique password generator along with speedy, more accurate form filling. This is designed to help teams use more diverse and complex passwords.

![Google Chrome's built-in recommended password generator example](https://images.ctfassets.net/23aumh6u8s0i/2XBCoxAqohI63tutNIOafV/15c757387aea7a476090158bb2829143/chrome-built-in-password-generator)

On sites that require passwords, Chrome will suggest hard-to-hack options. One of the most substantial of Chrome's updates, the password manager will save newly created passwords directly to your Google account. Employees can manage them within their accounts or directly in the Chrome toolbar. 

Though password security is crucial, this improvement may seem subtle compared to some of the more eye-popping features in this Chrome update. Let's move onto the new Chrome UI, design, and productivity features.

<include src="TweetQuote" quoteText="The new Chrome now includes a built-in password generator."/>

## A Reimagined Browser Makes Search Faster and Organization Easier

It's clear that Google is focused on making its users more productive. Over and above the rapid generation and storage of passwords, it delivers a valuable interface and design for everyday browsing.

A rounded tab scheme, as opposed to the straight edges in the former version, creates more space to manage web pages and documents across your open tabs. 

![Google Chrome's new UI and rounded design](https://images.ctfassets.net/23aumh6u8s0i/7zhFexF0zeF2HA8mzd6qgT/d89ca63d2a3971466a1aa24358c836e9/chrome-makes-search-faster)

The [improved UX](https://blog.nomnominsights.com/ux-uncensored-what-ux-and-product-people-say-when-nobodys-looking/) allows more space for website icons - the key to differentiating tabs on your browser. Even with fifty tabs open on one window, all fifty icons would be in view. 

You can also search for a specific page in Google's Omnibox - the main hybrid address and search bar. The Omnibox will now tell you if that page is already open, and a click of the new ‘Switch to this tab' option will take you directly there.

Google has already promised an even smarter Omnibox that can search your files from your Google Drive directly. As Chrome evolves, getting yourself to the right page will only continue to get faster and easier.

Employees in the U.S. spend an average of [eight hours a day working](https://www.bls.gov/charts/american-time-use/emp-by-ftpt-job-edu-h.htm) (and this is well below the averages of many high-performance roles in industries like finance and law). [Increasing employee productivity](http://blog.idonethis.com/productivity-software/) is critical to keeping teams on track and competitive, even if that means shaving off seconds with improved browser organization and search functions. These will add up over time, freeing up team members to dig into the most valuable tasks.

### It's not all about desktop: Chrome includes mobile browsing updates

Mobile search has also drastically improved, thanks to Google's careful consideration of one-handed, on-the-go features. 

![Chrome mobile browser updates](https://images.ctfassets.net/23aumh6u8s0i/4rg6oIKMw8sGkldmrucn2k/50bbd13bf308a0a0097c4021c4d3adc1/new-chrome-on-mobile-as-well)

Searching with one hand becomes exceedingly more convenient when you don't have to reach the top of the screen. The keyboard appears simply by clicking the new search button at thumb's length.

Google also makes it easier to jump between tabs on your phone by keeping the tab count next to the bottom search button. 

Click through to open tabs and you'll see the same rounded redesign from the desktop version on both iOS and Android. With a full view of each open page, the new look helps make your mobile tabs even more intuitive than on your desktop. Plus, this look matches up with the new Google Drive on your desktop, giving an even more cohesive feel to the whole Google family. 

In 2017, [49.7 percent](https://www.statista.com/topics/779/mobile-internet/) of web page views worldwide were on mobile devices — and mobile data traffic is projected to increase 7X by 2021. As more employees work remotely, travel, and rely on mobile devices, these small tweaks that Chrome has rolled out for iOS will make a difference.

## The Future of Search: What's Ahead For Teams That Use Chrome

Today, Chrome is the most heavily used browser, with over 60 percent of users relying on it.

![Statistics - Chrome is the most widely used browser in the world](https://images.ctfassets.net/23aumh6u8s0i/6Dw9jygFbyGYswOASX3Gks/f67b16dd6b64ad92d5949e57e9fc4644/browsers-usage-comparison)

The changes that Google makes will have far-reaching consequences for employee security and agility at work, helping everyone brace themselves in an [increasingly complex threat environment](https://auth0.com/blog/3-critical-lessons-from-the-t-mobile-data-breach/). 

While this Chrome update has provided the internet with a new look, tighter security, and more productive tabs, the real excitement comes in a reimagined future for upcoming Chrome models. 

With rumors of a [_URL-less browser_](https://www.digitaltrends.com/web/google-wants-to-kill-urls-to-make-the-internet-safer/) for safer browsing and further implementation of artificial intelligence, there's a lot in store that's bound to make life increasingly more efficient. 

Google has also indicated more "under the hood" security updates in 2018, including an improved ad filter to [_site isolation_](https://security.googleblog.com/2018/07/mitigating-spectre-with-site-isolation.html).

Lastly, Google also gave us a first glimpse into smart search bar answers—a convenient way to get answers to straightforward questions. For example, when you search for the weather, Chrome will give you the answer directly into the search bar - rather than taking you to a search engine page first.

![Chrome Omnibox search features include giving you answers directly in the search bar](https://images.ctfassets.net/23aumh6u8s0i/4vMgV5Hlxjsl3Poo171YNz/acbca889e63916c5ef09fcab2ccf245c/new-features-on-google-chrome)

With a deliberate focus on simple questions, this feature is designed for the moments when all you need is a quick explanation or an immediate reminder on a piece of trivia or even a language translation. 

As the Omnibox becomes increasingly smarter, the future of search is rapidly unfurling before our eyes. Google intends to continually improve how users find information—and keep it safe—in 2018 and beyond.

<include src="TweetQuote" quoteText="Chrome, the most popular browser in the world has a new version with a lot of great features.."/>

<include src="asides/AboutAuth0" />

New Chrome Improves Employee Security and Productivity

Enterprise SSO ensures better productivity, user experience, and security for employees through single-click access.

Leading up to the 2016 U.S. presidential election, Russian hackers allegedly attacked the Hillary Clinton campaign and the Democratic National Committee with [spear-phishing](https://www.pcmag.com/article/354240/spear-phishing-attacks-what-you-need-to-know) efforts to trick users into providing their usernames and passwords to fraudulent websites.

As cybersecurity concerns continue to mount, user credentials demonstrate a universal weak point in corporate security, and the more accounts and logins employees and IT departments must manage, the more hackers can find valuable openings. 

So how do companies navigate these risks in a world constantly pushing for more SaaS application use as they grow in size?

One answer lies in SSO, a way to enable single-click credentials and secure identity verification while also improving user experience. 

## What is SSO?

SSO—Single Sign-on—acts as a holistic, single login point where users enter one set of authentication credentials that grant access to a suite of other applications, regardless of the platform, technology, or domain used. 

Picture an office building with unique offices for a variety of related but separate businesses, each with their own key. 

But if it were using an SSO-like system, authorized personnel would instead use one key to get through the front door, sparing them the hassle of using separate keys to get into the individual offices. 

This is the general idea behind how SSO systems work for services like G Suite — where your Google account login gives you access to a variety of individual applications — and Slack. 

### How does SSO work?

Users begin their SSO experience by logging into a gateway, which can be displayed in a variety of ways, depending on the application a company uses. 

With Auth0, users are redirected to a login page with username and password fields, and may include Social Identity Providers such as LinkedIn, GitHub, Google, etc.

![Example Auth0 login screen - SSO in background](https://images.ctfassets.net/23aumh6u8s0i/3nHe9HYJtL71aEhJwAmUms/cbb668c190ab9abca22db8642f6b0084/enterprise_sso_auth0_example)

From there, the users go through the following steps: 

1. They enter their master username and password
2. The credentials are run through the Identity Provider (IdP) for verification, where the authentication server checks the credentials against the directory that contains stored data
3. If the credentials check out, the authorizing server will set an SSO cookie 
4. Users are then redirected to the application they want to access

In the future, users won’t have to see a login screen when accessing any approved application integrated with the SSO setup. 

Instead, when users want to log in:

1. the IdP checks to see if there is an existing SSO cookie; 
2. if necessary, the provider updates the cookie; and 
3. the IdP returns an ID token containing the users' identity information and logs them in. 

Note: During this process, users don’t see a login screen and are seamlessly directed to the dashboard of the application they’re looking to use. 

## 1. Enterprise SSO Improves Employees' User Experience

By using [enterprise SSO](https://auth0.com/single-sign-on), companies save employees time and effort by asking them for only one login and one set of credentials. 

These credentials work for all cloud, on-premises, and mobile applications and provide a hub for all company applications, rather than requiring employees to remember usernames and passwords for each tool.

SSO also provides employees with a more personalized experience by bringing all of their tools and resources into one hub. 

## 2. SSO Provides Multiplatform Access

<include src="TweetQuote" quoteText="Universal access provides employees with the flexibility they expect in the modern workplace and ensures IT security against the threats inherent in modern digital life"/>

By giving employees a single point of login, companies seamlessly provide their teams with multiplatform access. 

With recent studies showing that small companies use a mean of [13.4 different applications](https://www.intermedia.net/assets/pdf/Osterman_-_Survey_on_Application_Use_Within_Organizations.pdf), and large companies boast an average of [more than 15 applications](https://www.intermedia.net/assets/pdf/Osterman_-_Survey_on_Application_Use_Within_Organizations.pdf), SSO allows companies to reduce the chance of employees losing, reusing, and sharing passwords across a multitude of accounts.

That means employees aren’t limited to accessing key tools and resources only at work: They can also securely log into these applications from their homes and mobile phones or access them while traveling.

![Google G Suite apps panel](https://images.ctfassets.net/23aumh6u8s0i/yEX0HHdnz6XJUO4aPYhpj/c97ba95f168fe8d8d41061f18a5dd93b/enterprise_sso_google_apps)

[Source: [Google](https://gsuite.google.com/)]

This universal access provides employees with the flexibility they expect in the modern workplace and ensures IT security against the [threats inherent in modern digital life](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/).

## 3. Enterprise SSO Ensures More Secure Passwords

While employees objectively know they should create hard-to-guess passwords, the impracticality of remembering complex credentials often results in the reuse of weak passwords over and over again. 

In fact, [nearly 90% of people ages 18–30 use the same password_](https://keepersecurity.com/assets/pdf/Keeper-Mobile-Survey-Infographic.pdf) across multiple accounts. 

When employees give in to the demand for increasingly complex passwords in order to thwart hackers, the frequency of password recoveries skyrockets. Because of these complex password requirements, [_60% of people need to reset their passwords every 60 days_](https://keepersecurity.com/assets/pdf/Keeper-Mobile-Survey-Infographic.pdf) — a practice that also [_costs companies an average $179 per employee_](https://www.pingidentity.com/en/company/blog/2015/11/13/passwords_will_die_a_slow_death.html) [_per employee_](https://www.pingidentity.com/en/company/blog/2015/11/13/passwords_will_die_a_slow_death.html) and is largely avoidable with SSO.

When companies embrace enterprise SSO, team members have to remember only one master set of credentials. This prevents them from creating unique, complex sets of passwords, reusing weak passwords, or [_keeping physical records of all passwords_](https://keepersecurity.com/assets/pdf/Keeper-Mobile-Survey-Infographic.pdf) — all of which are inconvenient, costly, and insecure. 

<include src="TweetQuote" quoteText="Companies looking to save their employees time and provide peace of mind while improving individual and network-wide security can set up SSO with the help of Auth0."/>

## 4. Enterprise SSO Boosts Employee Productivity

Utilizing SSO for employees boosts productivity by reducing the time teams spend locked out of key tools while waiting for password resets and getting set up on new applications. 

Employees are also much more likely to know about and take advantage of resources and tools that make their jobs easier and faster and answer common user questions when those applications are linked to one hub, as SSO allows. 

## How Does a Company Set Up Enterprise SSO?

Companies looking to save their employees time and provide peace of mind while improving individual and network-wide security can [set up SSO with the help of Auth0](https://auth0.com/learn/how-to-implement-single-sign-on/).

Beyond the technical aspects of the switch, companies should keep in mind the following rollout tips to help their teams adjust to an SSO setup:

* Make sure to carry over login information so team members don’t have to reenter everything.
* Provide clear direction for users.
* Identify key applications that employees often use, including key software, cloud accounts, and social media.

4 Vital Ways Enterprise SSO Saves Your Employees Time and Provides Peace of Mind

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Security measures should augment productivity, not impede it



Your company would never let a random person walk through the front door of the office without authorization, grab a cup of coffee and start going through confidential files. In the digital workplace, this is exactly what is happening, minus the coffee.

Today, work happens in the cloud on multiple devices, which means your company's data and systems are accessible from anywhere.

You have to find new ways to manage your employees' identities and permissions, so the right people have access to the right systems and data. While security is critical, adding too many security measures hampers productivity.

So how do you balance security and productivity within [the modern digital workplace](https://www.interana.com/blog/how-leading-companies-are-tackling-the-challenges-of-digital-transformation/) where employees are using unsanctioned devices, running hundreds of applications and sharing company resources with outside partners?

Start with an identity and access management (IAM) tool that is designed to keep up with the pace of digital transformation.

### Simplify the digital workplace with IAM

Software for businesses is booming. But hundreds of applications running on unsanctioned devices poses a huge security risk and keeps IT professionals up at night.

While the complexities of managing access across so many tools and devices is a huge challenge, the benefits of the digital workplace are ushering in a new era of productivity where employees can work anytime, in any place with anyone around the world. [Digital transformation](https://www.interana.com/blog/curiosity-got-cat-promoted/) is moving fast, and it's your job to stay ahead of the game.

![The complexity of one employee's digital workspace](https://images.ctfassets.net/23aumh6u8s0i/3ILL4BCkM5rTmj9j8Y7aXd/f1114e008ecd6950c0173d3841eb0861/complexity)

[[Source](http://www.zdnet.com/blog/hinchcliffe/)]

That's why cloud IAM tools, like [Auth0](https://auth0.com/b2e-identity-management-for-employees), are growing so quickly. IT departments no longer need to manage access and authorizations in-house, or scramble to keep up with securing every new application and cloud system that employees bring into the corporate environment.

IAM tools simplify the complexity of the digital workplace by managing all of your user identities and access permissions across your internal systems, employee devices and cloud-based technologies. All of your users, both internal and external, are authenticated and authorized based on the roles that you set within one easy-to-use system.

IAM allows you to keep up with the pace of technology, but more importantly, the security features are designed to enhance productivity. Your organization can maintain high-level security measures, while removing the barriers that interrupt a productive workflow.

### Better productivity without a security compromise

Employees expect a quick and seamless experience when accessing all of their tools. When a user can't log in or is locked out, valuable time is lost contacting a help desk. Productivity comes to a screeching halt.

The whole point of [digital integration](https://amplitude.com/blog/2017/05/18/analytics-stack/) is to be more productive by eliminating tedious and repetitive tasks, including logging in to multiple applications every day. So how can you keep security and permissions in place while eliminating individual logins for every single application? Single sign-on.

In the same way your Google sign-on gives you access to several other applications like Google Analytics, Youtube, and Adwords without re-entering your username and password, good identity management will enable your organization to implement a [single sign-on ](https://auth0.com/blog/what-is-and-how-does-single-sign-on-work/)for your entire network.

Once users create their single sign-on (SSO) credentials, they'll no longer have to waste time logging in over and over, giving them a seamless work experience regardless of the application, device or domain.

![Single Sign On](https://images.ctfassets.net/23aumh6u8s0i/74KAL716uJ2wcnwhseJXRa/95dad10d4d42fabbd20490467815eb93/singlesignon)

Single sign-on drastically reduces IT help desk tickets and centralizes admin tasks like password resets. When a password is revised, the change automatically updates every app and system connected to the SSO. IT no longer spends all day helping users with access issues, while your employees enjoy a seamless, more productive work experience.

### Added security that provides flexibility

Employees need the flexibility to work on any device or register a new application to conduct business, but the proliferation of 3rd party applications has broadened the security surface area far beyond any internal IT department can manage.

Cyber threats have become an everyday reality for both large and small businesses. The [2016 Cyber Security Intelligence ](http://ibm.biz/2016CyberIndex) found that 60% of data hacks involved an employee's access data. Either a hacker used an employee's credentials or the employee abused their access privileges.

IAM tools that offer [multifactor authentication ](https://auth0.com/multifactor-authentication)(MFA) provide an extra layer of security that allows your team to use any devices and sign up for new applications without the worry of compromising credentials.

MFA is one of the best ways to identify and verify a user. By asking them for several pieces of information through various stages, the user must demonstrate knowledge (E.g. password or pin number) and possession (E.g. mobile phone). For example, a user is prompted to input their password, which triggers an SMS message with a unique code.

![Multifactor](https://images.ctfassets.net/23aumh6u8s0i/1AUVdavXrQLYR1Y5WFA0N0/6f190786a9012296aca348c5474d8887/multifactor)

[[Source](http://it.miami.edu/_assets/images/multifactor1.png)]


When something unusual is detected, such as a sign-in attempt from a new device, MFA requires the user to have two or more types of ID proof before gaining access. If your password is compromised, your account remains safe. Apps like [Auth0 Guardian](https://auth0.com/multifactor-authentication) offer easy setup for MFA security.

Multifactor authentication offers the flexibility for employees to securely access their resources wherever and whenever, enhancing their productivity.

### Automated permissions keeps business moving

The basic idea behind IAM is to grant each user access to their authorized resources using one set of credentials, which helps streamline IT's workload in tracking permissions. But the bigger challenge for IT is in keeping up with each user's ever-changing privileges status.

In a given week, you can have new employees needing access to start working, other people leaving the company who need their access terminated, and a variety of other employees changing roles, who require different levels of access.

Tracking each user's permissions within an organization is nearly impossible. Your IT team shouldn't waste their valuable time trying to keep up with these constant changes.

The right IAM tool centralizes control of identity and access with an interface that helps you manage every aspect of user ID including automating authorizations, creating and provisioning users, password resets and blocking and deleting users.

![Users](https://images.ctfassets.net/23aumh6u8s0i/G9b0mA8dKR8wYPxtlG2g5/abff6316bcae956309520dcb89242cb1/users)

Administrators can stay ahead of the constant changes by defining security protocols for specific applications and granting permissions to users to access resources at different levels from a central control panel. For example, when an employee leaves the company, your human resource system triggers IAM to terminate access for that user.

You can also automate authorizations by setting rules that define user requirements, such as by devices, location or by limiting unsanctioned applications from connecting to your corporate environment.

When an employee's status changes, they can't wait days for access. Automated permissions and centralized user management help you keep up with the daily authorization changes.

### Stay ahead of your company's digital transformation

Your digital workplace is constantly evolving as [technology continues to evolve](https://amplitude.com/blog/2017/04/26/digital-transformation-yellow-pages/). Employees have the tools and access to information to be more productive. The goal is to keep your company's resources secure without hindering this new level of productivity.

The right IAM technology solution should deliver the best-in-class security measures that work to create a flexible and efficient workflow for employees across all of their tools. When users have a great work experience, they probably won't thank you, but they will work faster and smarter, which helps the company succeed.


Enhancing Productivity With Identity and Access Management

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Former Auth0 Employee

Prosper Otemuyiwa

Yarn is a new package manager for JavaScript by Facebook. Learn how to use Yarn to increase your productivity.

---

**TL;DR:** There are several package managers in the JavaScript land: **npm**, **bower**, **component**, and **volo**, to name a few. As of this writing, the most popular JavaScript package manager is **npm**. The npm client provides access to hundreds of thousands of code libraries in the npm registry. Just recently, Facebook launched a new package manager for JavaScript called **Yarn**, which claims to be faster, more reliable, and more secure than the existing npm client. In this article, you will learn five things you can do with Yarn.

---

**Yarn** is a new package manager for JavaScript created by Facebook. It offers a fast, highly reliable, and secure dependency management for developers using JavaScript in their apps. Here are five things you can do with Yarn.

## 1. Work Offline

Yarn offers you the ability to work in offline mode. If you have installed a package before, you can install it again without an internet connection. A typical example is shown below:

When connected to the internet, I installed two packages with Yarn like so:

![Yarn init](https://images.ctfassets.net/23aumh6u8s0i/6Imo0acT6Gs64IH8jTwVQ1/26892a9ea5f6cc8e84f4569707aef49a/yarn-int)
_Create a package.json with yarn init_

![Install express and jsonwebtoken packages with Yarn](https://images.ctfassets.net/23aumh6u8s0i/42lSxWCr2ew4M6IFI0KDC1/775327790a7467412d01ce15cbfe88a4/yarn-add-packages)
_Install express and jsonwebtoken packages with yarn_

![Installation complete with Yarn](https://images.ctfassets.net/23aumh6u8s0i/1r4HWUk3WtSJjMGPOUTuhr/037e548a5603f26687cfaf39360a4a3c/yarn-completed-install)
_Installation complete_

After the installation was complete, I went ahead and deleted the *node_modules* inside my *orijin* directory and also disconnected from the Internet. I ran Yarn like so:

![Installing packages offline with Yarn](https://images.ctfassets.net/23aumh6u8s0i/6DL20SGupYx4sU9KzOxgAt/f7d786b68e975df1b1003a8f1c4ec757/yarn-install-offline)
_Yarn installed the packages offline_

Voilá! All the packages were installed again in less than two seconds. Apparently, Yarn caches every package it downloads so it never needs to do so again. It also maximizes resource utilization by parallelizing operations so that install times are faster than ever.

## 2. Install from Multiple Registries

Yarn offers you the ability to install JavaScript packages from multiple registries, such as [npm](https://www.npmjs.com/), [bower](https://bower.io/), your git repository, and even your local file system.

By default, it scans the npm registry for your package as follows:

```bash
yarn add <pkg-name>
```

Install a package from a remote gzipped tarball file as follows:

```bash
yarn add <https://thatproject.code/package.tgz>
```

Install a package from your local file system as follows:

```bash
yarn add file:/path/to/local/folder
```

This is particularly helpful for developers who constantly publish JavaScript packages. You can use this to test your packages before publishing them to a registry.

Install a package from a remote git repository like so:

```bash
yarn add <git remote-url>
```

![Yarn installs from a Github Repo](https://images.ctfassets.net/23aumh6u8s0i/7eAxYyJ4IuguqtasactfWs/604a258c9aa536e4364a438482c398c0/yarn-add-gitrepo)
_Yarn installs from a Github repo_

![Yarn detects that a Github Rep exists as a package in the bower registry](https://images.ctfassets.net/23aumh6u8s0i/43r9Pc5tltOEWWYrY4kS9a/e92b4686e9c6c1872f748dda47a14548/yarn-add-bowercomp)
_Yarn also automatically detects that the git repo exists as a package in the bower registry and treats it as such_

## 3. Fetch Packages Speedily

If you have used **npm** for a while, you must have had experiences where you had to run `npm install`, then go watch a movie, and come back to check whether all the packages you required are finished installing. Well, maybe not that long, but it takes a lot of time to traverse the dependency tree and pull dependencies in. With Yarn, installation time has really been cut down from having to wait several minutes to package installs happening in seconds.

Yarn efficiently queues up requests and avoids request waterfalls to maximize network utilization. It starts by making requests to the registry and recursively looking up each dependency. Next, it looks in a global cache directory to see whether the package has been downloaded before. If it hasn't, Yarn fetches the tarball package and places it in the global cache to enable it to work offline and eliminate the need to re-download.

During install, Yarn parallelizes operations, which makes the install process faster. I did a fresh install of three packages, **jsonwebtoken**, **express** and **lodash**, using **npm** and **yarn**. After *Yarn* was finished installing them, *npm* was still installing.

![Comparison of Yarn and Npm](https://images.ctfassets.net/23aumh6u8s0i/4UGNjRN84eSDhTVtDaMZN7/0bca8f7ff2e0986e352adf130432d54f/yarn-npm-compare)

## 4. Lock Package Versions Automatically

Npm has a feature called **shrinkwrap**, which is intended to lock down your package dependencies for production use. The challenge with **shrinkwrap** is that every developer has to manually run `npm shrinkwrap` to generate the `npm-shrinkwrap.json` file. Developers are also humans; we can forget!

With Yarn, it's a different ball game. During installation, a `yarn.lock` file is generated automatically. It is similar to the `composer.lock` file that PHP developers are familiar with. The `yarn.lock` file locks down the exact versions of the packages that have been installed and all their dependencies. With this file, you can be certain that every member of your engineering team have the exact package versions installed and deployments can easily be reproduced without unexpected bugs.

## 5. Install Dependencies the Same Way across Machines

The **npm client** installs dependencies in a way that can make the structure of the contents of *Developer A* `node_modules` directory different from *Developer B*. It uses a non-deterministic approach to install these package dependencies. This approach is sometimes responsible for bugs that can't be easily reproduced because of the popular *works on my system* problem.

With Yarn, the presence of a lock file and an install algorithm ensures that the dependencies installed produce the exact same file and folder structure across development machines and when deploying applications to production.

**Note:** One more thing, I know I promised five but I can't help tell you how good **Yarn** makes me feel. Enterprise environments require the ability to be able to list a dependencies' license type. Yarn offers the ability to list the license type for a given dependency by running `yarn licenses ls` in your root directory as follows:

![Yarn Licenses](https://images.ctfassets.net/23aumh6u8s0i/2CT4v5mObOSAptOxiNId6O/ce758c59da1df693560888cc679773f8/licenses)

## Aside: Using Auth0 with Yarn

**Auth0** issues [JSON Web Tokens](https://jwt.io/) on every login for your users. This means that you can have a solid [identity infrastructure](https://auth0.com/docs/identityproviders), including [single sign-on](https://auth0.com/docs/sso/single-sign-on), user management, support for social identity providers (Facebook, GitHub, Twitter, etc.), enterprise identity providers (Active Directory, LDAP, SAML, etc.) and your own database of users with just a few lines of code.

We can easily set up authentication in our JavaScript apps by using [Auth0's Centralized Login Page](https://auth0.com/docs/hosted-pages/login). You can easily install the `auth0-js` library from your terminal with Yarn like so:

```bash
yarn add auth0-js
```

It installs the library within seconds and locks down the exact version with the aid of the `yarn.lock` file. If you don't already have an Auth0 account, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up</a> for one now. Navigate to the Auth0 [management dashboard](https://manage.auth0.com/), select **Applications** from the navigational menu, then select the app you want to connect with the JavaScript framework of your choice. Now head over to the [Quickstart docs](https://auth0.com/docs/quickstarts), select the type of app you want to build and follow the steps highlighted there.

## Conclusion

Yarn in its infancy has already brought significant improvements in the way JavaScript packages are fetched from global registries into local environments, especially with regard to speed and security. Will it grow to become the most popular choice among JavaScript developers? Have you switched yet? What are your thoughts about Yarn? Let me know in the comments section! 😊

"productivity"