Zero-downtime SSO for a supply-chain SaaS serving 500+ enterprises and 50K+ monthly users

Client story

Every growing company reaches the point where the number of users and clients rises faster than manual processes can handle. That calls for a user enrollment system that scales with growth and meets a heightened emphasis on security.

Our customer, a global supply chain SaaS whose users include Fortune 500 companies and government, faced exactly this. Optimizing new-user enrollment resulted in 3x business scalability.

• 500+ enterprises use the solution, including Fortune 500 companies
• 50K+ active users a month
• 30+ enterprises added a year

Challenge

The company, a multi-billion-dollar business, had a self-built login system in which an administrator added every user by hand. That drove up cost (the cost of enrollment divided by the number of users added per month), weakened security and constrained the business’s ability to scale.

After evaluating the corporate procedures and the technical state of the platform, our domain experts recommended implementing SSO.

Solution

After analysing the system, the client’s expectations and vision, and the implementation options, we had to choose the most cost-effective and suitable route. We could build SSO from scratch or integrate a ready-made solution. After comparing the options we chose to integrate the open-source Red Hat build of Keycloak.

Why Keycloak:

• It implements the security standards OpenID Connect, OAuth 2.0 and SAML.
• It fits the core product’s tech stack and functional requirements.

The core application is written in Java, so Keycloak, itself a Java product, matched well and integrated cleanly with the existing WildFly application server. Out-of-the-box integration with multiple identity providers (Microsoft, Oracle, Okta, Google, Facebook and others) is what produced the business results.

For supply chain companies with a large network of suppliers and partners, it is also valuable to keep partner data on a separate, secured server. Keycloak provides a separate SSO server for that purpose, which streamlines business processes as well.

How it works

Using the OpenID Connect and SAML 2.0 standards, the application redirects the user’s browser to the Keycloak authentication server to enter credentials. We register the specific entity in the system that customers use to sign up for the SaaS, so users do not have to enter credentials manually: they enter through accounts they already hold with Google, Okta, ADFS and other third-party systems.

The SSO server manages existing users and also adds users imported through our clients’ own identity providers.

Architecture and tech stack

The Java EE 7 core on WildFly delegates authentication to a Keycloak server over OpenID Connect and SAML 2.0. Keycloak federates external identity providers and runs a separate SSO server for partner and supplier organizations. Spring services and Kafka carry user and event data within the platform, all hosted on AWS.

• Keycloak (Red Hat build)
• OpenID Connect, OAuth 2.0 and SAML 2.0
• Java EE 7 on WildFly
• Spring
• Kafka
• AWS

Results

Erbis resolved the challenge strategically and cost-effectively by integrating the SaaS platform with an open-source SSO service that implements all required security standards and works with multiple identity providers.

Managing access for external partners and vendors became simpler, which reduced the cost and time of onboarding and managing third-party user access, and lowered security risk.

The implementation delivered high availability and zero downtime. It scales with current business needs and is ready for any surge in customer traffic.

What made it work

Erbis’s takeaways from this engagement:

• Buy the standard, build the integration. A proven open-source identity server that speaks OpenID Connect, OAuth 2.0 and SAML beat a custom login system on cost, security and time to value.
• Pick the component that matches the stack. Keycloak’s Java heritage and WildFly compatibility made the integration low-risk for the existing platform.
• Let customers bring their own identity provider. Federation with Google, Okta, ADFS and others is what removed the manual enrollment bottleneck.
• Separate partner identity from core identity. A dedicated SSO server for suppliers and partners kept a large external network from becoming a security liability.