Slashdot Mirror
Oracle Shuttering OpenSSO
mdm42 writes "OpenSSO is one of the best open source web Single Sign On projects out there. Sun Microsystems made OpenSSO open source in 2008, so it's sad to see how, after absorbing Sun, Oracle is shutting down this amazing project, labelling it 'not strategic' and dismembering the few parts they think are worthwhile for their own SSO effort. They started by freezing the next express release, and during the last few weeks they have been removing all the open source downloads from the OpenSSO website and removing content from the wiki. Fortunately, a Norwegian company called ForgeRock has stepped up to the plate in an attempt to salvage the project under the new name OpenAM."
Sadly, probably yes...
Another nail in the once proud legacy of Sun.
This may be a test to see if they get attention for shutting down an open source project they inherited in order to also in the long run do the same to MySQL and possibly also other OpenSource projects.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
MySQL would be a very high profile project to kill. I think it is more likely they would provide much less support and engineering resources for it going forward, leaving it to the community outside of Sun to keep it feature and bug competitive.
Oracle is probably trying to leverage her own Identity Management product against IBM and Novell, who are kings on this market.
Grey's Law: Any sufficiently advanced incompetence is indistinguishable from malice.
because it was OSS, it can be forked and survive. :)
OpenSSO is not a trademark of Oracle/Sun, you can see a list of trademarks for Sun at http://www.sun.com/suntrademarks/
Free means no restrictions, ironic the FSF's GPL forces restrictions, isn't it? What's your definition of free?
I think it is more likely they would provide much less support and engineering resources for it going forward, leaving it to the community outside of Sun to keep it feature and bug competitive.
Pretty much what I meant...but a fork surely won't be as credible with the corporate suits as a product with Sun behind it.
Shame, MySQL & Ooffice are both great products IMHO.
Maybe a white knight (with a Red Hat?) will take it over, but I'm sure if they're too successful than Larry will find a way to stymie it...
oraclepleasedontkillmysql.com is still available ... I sure hope Oracle doesn't get it first ...
Well of course not. If it doesn't make Oracle money, it will be gone.
---- Booth was a patriot ----
Will see the same fate.
---- Booth was a patriot ----
Isn't FOSSSSO so much more appealing?
You keep using that word. I do not think it means what you think it means.
As much as this is a bummer, it's actually a great example of the OSS model at work.
If this was a closed source solution, where the company got acquired and the product wasn't strategic, the solution would just be gone.
With OSS though, another company - for whom the solution is strategic - can step in and pick up the project.
Custom, hands-free Linux installs. Instalinux
SSO is a pretty backwards way to do Open Source Software.
What does this OpenSSO do for me that Kerberos doesn't?
If Oracle wants to do something useful with the Sun assets, they should kill off java. Java is an abomination upon the IT world. I have yet to see a well-written unbloated java app.
Case in point: RSA rewrote their entire SecurID one-time token server in java. What used to be a fast, nimble application that started within 15 seconds now takes 15 minutes to start. RSA recommends 60 gigs of free space. The previous version required 200 megabytes.
please, those who have the tendency to batter me with hardliner conservative arguments in discussions, make a mental note - this is one of the cases i always give examples of success of social democracies, and how heavy regulation and keeping-in-check of corporations spurs innovation far more than the reckless corporate owned environment does. an american company, which lives in a land in which corporations rule, shuts down something useful, and that useful thing gets immediately salvaged by a company which lives in a land in which corporations are heavily kept in check and regulated. and again, another scandinavian country.
Read radical news here
This has got to be the height of irony. Lamenting, a commercial entity is dropping a project that doesn't make money... But, isn't the beauty of open source related to the fact that those who care, can pick up the source and make it work? So, prove it.
If you want the source you can get the info to obtain it from here http://wikis.sun.com/display/OpenSSO/CVS+Tags
I'm grabbing the source now.
- Hi we are Sun and we have this portal. You want to buy a commercial license for it?
*buys*
*six months pass*
- Oh hi we decided to drop that portal and switch to this Liferay-based Webspace solution none of our techs really know anything much about?
*grumble*
*a year passes*
- Oh hi again, we were just bought by Oracle and will be abandoning Webspace, would you like to switch to this WebLogic-based monstrosity instead?
*curses*
That is in addition to the OpenSSO/IDM kerfuffle.
Another somewhat related open-source project has had no commits since January 25 http://www.opends.org/source/xref/trunk/
Like I posted a few weeks back, /. needs to save a template to re-use each time they feel the need to write a story about a marginally-relevant, minimally-staffed, largely-forgotten Sun project that Oracle shuts down.
Why? MySQL is a goose laying golden eggs. Why would Oracle kill it?
They will charge for the support and engineering, just like Trolltech and Sun did.
Faster Than Light, indeed
Once you go opensource, you can't go back.
Views expressed do not necessarily reflect those of the author.
Why not use Jasig CAS instead? Not that it will be any consolation that Oracle is trying to profit off its expensive SSO solution, but CAS is easy to implement with a Java and Ruby version available, and hundreds of universities are using them. We're a private business and we use CAS easily with phpCAS and RubyCAS-client. It's easy to use and implement, and systems such as PeopleSoft can easily be CASified. While it's sad OpenSSO is being discontinued, CAS is not an option likely to disappear any time soon. We strong recommend those considering replacing their OpenSSO system to move to CAS.
Another way to look at this move is that open source projects have a significant dollar value, if for no other reason that the project may compete for market share with other products. One could certainly see the strategic benefit of supporting a "hard to kill" project to compete with a market leader. Now, we have an example of such a project becoming an acquisition target.
This is no different than a company which buys out their competitor for the purpose of "integrating" (e.g., shutting down) a competing product line. Luckily, unlike proprietary solutions, this project will fork back to the community and live on, albeit without Sun's corporate backing.
OpenAM appears to have simply imported a snapshot of the tree into SVN. Interested parties should probably back up the entire CVS history of OpenSSO using a tool like, for example, cvssuck, in before it is "unpublished".
I'm surprised no one has mentioned Shibboleth. Shib is pretty popular in the higher-ed space. There is a bit of a learning curve when first playing around with it, but once you get it up and going, it's very powerful. It does more than just your average SSO by providing federated authentication across organizations while maintaining user security. The project page is at shibboleth.internet2.edu
Now that Oracle has its own VM solution...
I've actually been involved with the OpenSSO project during the last 2 years or so, and I honestly don't think it will disappear at all. It had a very active and vibrant community which supported it, many of which have already made the jump to help ForgeRock.
On top of that, OpenSSO/OpenAM already has some terrific features. Its Agent interface is superb, the SAML engine is rock solid, FEDLETs are ahead of their time, and it even had a well documented API for integrating directly into your own application. That's not to say that OpenSSO didn't have room to expand (I found its STS service to be "finicky"), but I expect many of these issues will be addressed by ForgeRock.
I understand that Oracle already has it's own IAM suite, but I think dropping OpenSSO will be something that they regret.
OpenSSO is dead. Long live OpenAM!
Do they want us to go from a situation where SSO in Windows is the standard on LANs, to SSO in Windows to Facebook or Windowslive servers becomes the standard in the Internet?
Because that is the direction that Microsoft is going in with what was Active Directory.
I'm new to Oracle and working in SQL plus. There are several old views that were created before my time. Top Grade Acai Extreme
Why? MySQL is a goose laying golden eggs. Why would Oracle kill it?
Are you nuts? That fucker is full of GOLDEN EGGS!!! Haven't you heard of killing the goose that lays the golden eggs?
Geez, kids these days.
An unfortunate name choice. OpenAM translates to turkish as "Open Vagina"
Give it 1-2 years, then it isn't as high profile any more. Support will dwindle with uncertainty, which is what will be as long as they have an obviously competing product (regardless of what they say)
Remember, they have made a 5 year commitment to "supporting" it - but there's no marketing plan other than to keep people in doubt with uncertainty.
Damn it.
I work for a company that has their whole intranet and a great deal of their extranet build on Sun Portal Server. While the portal server itself is mostly crap, Access Manager (now called OpenSSO) is actually a great product. We had just a couple of very minor problems which were easily resolved in the last 6 years. We planned to either upgrade to Webspace or to maybe just keep OpenSSO and go for Liferay directly. There are a lot of managers who cry Sharepoint, Sharepoint but so far we were defending well and could keep that crappy thing out.
What I really hate here is that the Sharepoint faction will use this as an argument (Reason doesn't matter, FUD always works!). I see a lot of tedious discussions of how to proceed coming...
there are too many who have been brainwashed with american corporatism and deceived to believe that they too can 'make it big'.
Read radical news here
WSO2 has an Apache licensed identity and entitlement server that includes SSO.
You see? That is the problem with using your anecdotal eveidence and then making a statemtn based on that like if it was an undeniable fact.
In any company that is no longer small (I would say 10 people or more) having a password for every single application is simply not practical. Not only that, it is insecure.
Then what you do is looking for a central authentication solution paired with application configuration to control entitlements (not there is something fun but unsexy for the geeks: an entitlement architecutre to which any application could refer to).
If you don't do this then the "post-it" password creep becomes a real problem (eletronic password wallets are a band aid, you need a centralized version, hopefully with host authntication, to ensure that only people working in authorized machines can be authenticated).
The advantages for "Joe Six Pack" in the wider world are obvious, but since most people don't care about losing the password to their Twitter or Facebook accounts, then there is no push for personal computing to use SSO solutions.
But any complex organiztion is stupid if they are not considering this, that an open solution to this problem is struggling is a very bad thing indeed.
Do I need to care about this at all?
I understand the value of SSO and all that stuff, but I can't say I'm an expert in the field. Can someone who knows something about SSO and OpenSSO give me an idea as to whether or not I should even care that OpenSSO has been killed?
Was it especially novel? Was it used by anybody? Did it work well? How does it compare to other, similar solutions? *Do we, the open source community, need this?*
I want my Cowboyneal
Never underestimate the economic power of a vast user base, some of whom will buy support contracts, and perhaps upgrade to your flagship product in the future. OpenSSO didn't have a following (or upgrade path) anywhere near as large or lucrative, which made them vulnerable.
I prefer rogues to imbeciles because they sometimes take a rest.
Everett (www.everett.nl) also supports opensso.
http://www.openssosupport.com/
Suresh Samuel
Most of the directories are very general in scope and list websites across a wide range of categories, regions and languages. But there are also some niche directories which focus on restricted regions, single languages, or specialist sectors. One type of niche directory with a large number of sites in existence, is the shopping directory for example. Shopping directories specialize in the listing of retail e-commerce sites. Examples of well known, general, web directories are Yahoo! Directory and the Open Directory Project (ODP). ODP is significant due to its extensive categorization and large number of listings and its free availability for use by other directories and search engines. However, a debate over the quality of directories and databases still continues, as search engines use ODP's content without real integration, and some experiment using clustering. There have been many attempts to make directory development easier, such as using automated submission of related links by script, or any number of available PHP portals and programs. Recently, social software techniques have spawned new efforts of categorization, with adding tagging to their product pages. Directories have various features in listing, often depend upon the price paid for inclusion: Some web directory have : 23$ featured link or 12 $ regular link for life time ex: http://www.microsoftcompany.com/
I don't see them killing Open Office, they don't have anything that competes with it and it is a minor thorn in the side to Microsoft, both things that Oracle likes. They have an SSO product, they have a database product so these would not be surprising targets for them. I'm very interested in finding out what's going to happen to OpenSolaris, I've recently been doing a proof of concept with Nexenta to replace our aging proprietary storage system and I really like it. Hard to say what tactic they'll take with that but I don't think it's going to go exceptionally well for OpenSolaris either. Oracle has been supporting Linux simply because they needed an operating system in order to supply the full stack for an enterprise solution (my estimate of what Oracle's goal has been). I don't necessarily think that Oracle will continue supporting an open source operating system if they have a proprietary one, and I think that includes OpenSolaris. So I would likely see that following the same pattern of decreased support and resources that MySQL open source will likely get as well.
Oracle has another tool for SSO, used to be called Core Id and changed to Oracle Access Manager. It is kind of a crappy product, but does work OK. It has a terrible interface, poor deployment model, and terrible integration to app servers, but otherwise works well. I am betting this more than anything is why they are killing open sso.
Maybe you didn't read the MySQL licence... "Sun makes its MySQL database server and MySQL Client Libraries available under the GPL for use with other GPL-licensed software and FOSS applications licensed under GPL-compatible FOSS licenses. In addition, for open source projects and developers creating and distributing open source software under certain FOSS licenses other than the GPL, Sun makes its GPL-licensed MySQL Client Libraries available under a FOSS Exception that allows distribution of the FOSS application with the MySQL Client Libraries without causing the entire derivative work to be subject to the GPL." and keep reading it at MYSQL site
Any software project that does not fit in the above description must pay a licence.