At Nordic APIs this week, I was very proud to announce that we have partnered with Janrain, the leader in social media aggregation. We are delighted to become Janrain's only reseller in Scandinavia, and are excited by the opportunities that this opens up to our customers. This partnership is a critical part of our business model, and our strategy to help organizations more quickly adopt cloud computing, mobile, big data, and social. To do this, we are bringing together standards-based software from best-of-breed vendors like Janrain into ready-made solutions. These pre-made integrations allow organizations to quickly and securely overcome the challenges introduced by these four megatrends. Our ready-made solutions, deep knowledge of our partners' offerings, and the standards on which they're built allows us to speedily implement solutions using their software, sparing our customers from lengthy integration projects.

As I've blogged about before and described in our whitepaper, solutions for cloud, mobile, big data, and social have to be created from various software components in the same sort of way that a baker combines base ingredients into cakes. To make a torte, you need eggs, flour, sugar, milk, and, in the hands of a skilled baker, these can be whipped, stirred and combined into wonderful desserts. Similarly, we are pulling together software, services, and expertise into secure solutions for a mobile, cloudy world. Our ingredients are things like Web SSO, account management and provisioning, API security, and authorization. With this new partnership, we can also whip in some social media aggregation using Janrain's products.

At Nordic APIs, I gave a demo of such a solution that combines Janrain's services with CA SiteMinder to securely integrate social into a Web site. We'll post a recording of that in the next couple of weeks, and will show it off again in Copenhagen. We also have other integrations in the works, and we'll blog about those soon. In the meantime, check out Janrain's site which has a wealth of helpful info explaining how engagement starts with identity. You can also shoot us any questions you may have about their products or about how we're helping organizations use their platform to securely leverage social login, profiles, and publishing to increase brand engagement.

As the year rolls over, we naturally ponder the future. Reading through popular IT news sources, we are presented with a future where organizations inevitably allow staff to use their own mobiles at work, a practice referred to as Bring Your Own Device (BYOD). It is easy to see why so many people are talking about it with potential benefits such as these:

• Cost reduction from employees paying for their own devices (at least in part);
• Increased employee satisfaction and productivity;
• Greater innovation through employees' use of cutting-edge technology; and
• Improved business agility and mobility.

I was discussing this topic with a group of friends at a recent Christmas party. To my surprise, one of them who has been working in the Swedish IT industry for years had never heard of BYOD. This got me to thinking: How widespread is BYOD adoption in Sweden, Scandinavia, and Europe? From the one Noel party, it seemed to be lagging, but that's a single data point. After looking around for others, I thought I'd share my findings.

In light of Gartner predictions that BYOD adoption will climb in 2013, Lisa Bjerre asked a handful of Swedish IT execs whether they agreed. Some were skeptical, but the directors of IT for the municipalities of Burlöv, Götene, Lidköping, Essunga, and Skara predicted that BYOD will introduce creative new ways of delighting customers and will greatly impact Swedish organizations in the coming years. Burlövs municipality's IT director, Hans Magnusson, said he especially expected an uptake in Swedish schools as is happening elsewhere in the world. Adoption doesn't seem limited to the public sector though. Patrik Malmquist, Enterprise Mobility Manager at Sigma, says that mobility, including BYOD, is the most frequently requested issue that their customers come to them with. When McAfee asked 153 Swedish CIOs and IT managers about their views on BYOD, 60% said it was strategically important to their business, and over half thought it was something their companies should be investing in.

What about the rest of Scandinavia? Smartphones Telecom, a Norwegian Mobile Device Management (MDM) provider owned by Telenor, says that BYOD is not as common in Norway as in other places like the US, but the growing popularity of tablets means that more employee-owned slates will find their way into Norwegian workplaces. According to Steria's recent survey of 299 IT managers from large organizations in Denmark, Sweden and Norway, BYOD is not top of mind for IT bosses in the region. As Thomas Okke Frahm, former Executive Partner at Gartner in Denmark, warns, however, Danish directors of IT who oppose BYOD do so in vain. This is because workers will simply and insecurely use their own devices beyond the view of IT. Shadow IT is commonplace among BYOD opponents in Sweden, says Andreas Krohn, API Specialist at Dopter, a partner of ours.

As Berlin-based reporter, Charlotte Erdmann, writes, Europe is catching on to BYOD:

Research and consulting firm Frost & Sullivan has established that 75 percent of Europe's CXOs are already using tablet computers. And IDG Connect reports that 60 percent of European IT professionals now use their own iPads for work...Dell ascertained...that whenever private hardware isn't banned in a firm, four out of five employees use their own devices at work.

With more data points than the one from my Christmas party, it's clear to me now that many Swedish, Scandinavian, and European organizations are allowing or considering to allow the use of employee-owned devices in the workplace. It's also clear after doing this research that not many people are offering solutions to the problem. We've written a paper with concrete advice, and will discuss this at a BYOD conference in Stockholm on the 21st of February with Ping Identity, UnboundID, StjärnaFyrkant, Telia, Nokia, Sony, and others. More on that and our whitepaper soon. In the meantime, comment here, on Twitter or on Google+ if you have thoughts or views on BYOD adoption in Europe that you'd like to share.

At the end of Paul Madsen's presentation at CIS a couple weeks ago, he ended with a question that he also posed on Twitter:

The integration of SAML, OAuth, OpenID Connect, SCIM, and other neosecurity standards are relatively straightforward. The fly in the ointment though is XACML. How does it fit w/ all these other security specs? Matt Topper offered his thoughts in reply to Paul's tweet:

When I borrowed a similar deck from Paul for a recent presentation in London, I left off w/ the same question. I was followed that day by David Brossard, VP of Product Management at Axiomatics, a company specializing in XACML who we've since partnered w/. Him and I talked about Matt's point in the blogosphere a couple years ago and discussed these things more that day. After all these conversations and time, let me try to summarize my current thinking on how XACML integrates with protocols like SAML, OAuth, and OpenID Connect.

A few months ago at the Cloud Identity Summit (CIS) in London, I gave a presentation on the emerging standards that enable secure access to cloud APIs. The collection of protocols that form the neosecurity stack that I talked about are Simple Cloud Identity Management (SCIM), SAML, OpenID Connect, OAuth 2, and the JSON-based Identity Protocol Suite (JOSE and JWT). These security protocols are quite new (save SAML), and many attendees had not heard of some of them. They are very important for those implementing APIs and SaaS applications though, so I wanted to explain them in a bit more detail.

OpenID Connect and OAuth 2

These two protocols are a really big deal. Together, they provide authentication and delegated access to APIs, respectively.

OpenID Connect is essentially the third version of OpenID. It is a complete rewrite of the protocol and is not compatible with previous versions. It is an HTTP-based protocol that allows apps to authenticate users in foreign security realms. In this way, it provides SSO. Unlike other protocols like SAML and WS-Federation that solve the same problem, OpenID Connect provides the following unique benefits and features:

• Built atop OAuth 2 which is much simpler to implement than prior versions of that spec
• Designed with native mobile apps and HTML 5 Web apps in mind
• Designed to achieve higher Levels of Assurance (LoA)
• RESTful in nature, providing all the benefits of that modern design paradigm
• Low tech barrier that requires little more than HTTP and JSON support

For more info on OpenID Connect, see the OpenID Foundation's Web site. We'll be blogging about the importance and benefits of OAuth 2 in some of our upcoming posts. Connect on Twitter if you are curious before then.