Symantec Siteminder Reviews

SSO provides out-of-the-box authentication for the majority of the apps; and it provides a holistic solution for the company. Right now, we are using an on-premise solution. If we want to move to the Cloud, CA has that solution as well. So we’re positioned quite well to move into the Cloud as well.

They take the authentication and the core screen authorization out of application code. They also integrate with other security products very well.

SSO has impacted security on the whole. It has provided a very good user experience. We have recently moved from an experience in which users had to log in multiple times. Now they love it because they don't even have to have a log in because we integrated certain functionality from the CA side, like integrated Windows authentication. Users love it for certain applications where they had to log in a number of times during the day.

CA has come up with and has talked about Cloud-based solutions. I would like to see more mature ideas than what they're providing. I'm sure they have that on their roadmap. There are certain integration points that can be leveraged and made more easy to deploy, like the REST APIs and things like that. That is an opportunity to make deployment easier for any employer or for any company. They are talking about it. It’s going in the right direction. That’s for certain.

The stability of the solution depends on how you implement it. It's stable. There are no known issues. If there are patches required, CA provides patches regularly. Overall, it is pretty good.

There's really no limit to scalability if you have the right hardware and right architecture. I wouldn't put it on the product. It's how you deploy the product. Thousands and millions of authentications are done in seconds and milliseconds, so scalability is not an issue at all.

The company has used technical support. It's usually used if they need upgrades. If they need some help, they have it. The technical support is on par with the current level of support in the industry.

This happened before my time, so they actually had either a home-grown product, or they had some legacy systems for provisioning or for authentication. They had a different product which wasn't doing exactly the same thing, but this a very mature product. This has been there for a long, long time, for the past 20 years now.

They evaluated other options before choosing this one way before I was there. However, for example, there are other security and security engineering products that they're currently evaluating. Some of them are from CA, and some of the others are in-house. For example, privileged access is an important one and the company's talking to CA about Privileged Access. They have a product which is not really meeting their requirements today. Hopefully, the Privilege Access one will take care of that.

In choosing a vendor, the relationship is one of the most important factors. In today's world, everybody has the same features, so it’s the relationship that matters. It's not a vendor. It's a partnership. You develop that, and you're pretty much covered.

It depends on what requirement is the most important to them. Is the Cloud the most important thing to them; or is in-house important to them? The main consideration is what issue are they trying to address? If they're trying to address the user experience, everything holistically: CA, Oracle, RSA, they're all, again – it all depends on the relationship and what CA provides.

The most valuable feature is that it takes a lot of the logic for authentication and authorization out of the hands of your application and moves it into a centralized framework. Once we have our authentication and authorization policies set, they are easy to duplicate across all our applications instead of trying to develop them into each application individually. That’s where we probably see the most benefit or the most cost savings for our organization.

It has reduced developer costs; we get some of that back. Before, when we used a tool that was engineered in-house, it still required a lot of developer resources. Every time we created a new application, it needed to integrate into our in-house solution.

As we are now moving away from that, this product gives us the ability to have single sign-on zones expand outside of even what was normally our in-house product, to now use things like federation and SAML to carry out single sign-on, to things that might not even use the single sign-on solution from CA.

Increased single sign-on zones and then saving on developer time/costs are the biggest benefits.

One thing that we found a little difficult, was the default functionality to understand error messages coming back from a directory. You had to either use an add-on product or an advanced password service or perhaps change components within your directory, just to understand a simple message whether if a password has been expired or if it was incorrect.

Since then we have bought an additional SM Walker product, which is a third-party solution to resolve this issue. However, it would be nice if that aspect of the solution was a default functionality, within this tool itself and not something that you had to purchase as an add-on feature.

It has been good, after the initial first year or two that we purchased this product. When we first started out, we had some implementation issues; maybe it was not configured correctly and that caused us some problems.

Once we figured out those issues, it has been very stable since then.

Once we were familiar with the product, we haven't had any problems with its scaling. We had to figure out the factors that need to be increased so that we can scale up and also elements to look for as far as performance is concerned. We continue to use it more and more, along with an increasing number of applications being brought over.

We have used technical support quite a bit. Once we get connected to someone who understands the issue and can explain the necessary solution to us, it has been very good. For us, getting to that person or to the second level of support is time consuming. We have to jump through a lot of the same hoops in order to get to that person. The initial first level support is not as great, however once we get to that second level, we usually get back meaningful solutions that help us out.

Initially we didn't find the need to invest in building ourselves. We had an in-house product that we had developed and as time passed by, there were some security holes that can be found in any existing product. It wasn't cost effective for us to maintain it. Hence, the decision to purchase a third-party software like CA Single Sign-On/Shibboleth/CAS made a lot more sense as the expense incurred for purchasing any of these products was much less than for us to create or develop our own in-house solution.

Basically, it did not make a lot of sense to try and reinvent the wheel when nothing unique was needed for our organization. It was just more logical to buy another tool versus using an in-house product.

With the default set up, there is always a limitation on the number of connections that you can have under your policy servers. We didn't know this and it wasn't something that we were informed of, during implementation. As a result, as soon as we hit the maximum limit we started experiencing issues. It probably took us about a month to figure out the solution, which ended up being rather simple but that was a big bump in the road for us and hurt us in the initial stages itself.

During implementation, make sure to verify the tuning guide. We had a transition with our implementation person, who was changed in the middle of the process. In our case, factors such as maintenance and performance tuning were skipped over. We didn't really get to those aspects until we were live-in production and then needed to work out some of these issues. Thus, don't underestimate such a situation because when you experience such issues your customers are also going through them and then at that point it is public.

Mostly, our experience with this product has been good. There are areas that we think could be improved but mostly, we are happy with it.

The 2 other systems that were seriously considered were Shibboleth and then CAS. One of the main reasons as to why we decided to purchase this product, was the authorization functionality that exists in CA SSO. It was more suitable for a lot of our products as we could save time in the development aspect. I am not sure if any such functionality did exist at that level or complexity in either Shibboleth or CAS. Thus, for us this was a major selling point.

We are talking about the authentication products in general. What was previously SiteMinder, AuthMinder, some of the risk based authentication products that they have. I think the mainstream use that we have for the products are probably around web single sign-on. Being able to sign on to applications, the users not having to authenticate again. One of the good features we get out of the product as well is to be able to include different authentication methods. We use username and password but we also use smart card authentication, which is very key to our company.

Two factor authentication based on hard token effectively. Yeah the main thing I guess is, well two things. One is end user experience, so single sign-on. Before the product was introduced, we had multiple sign-ons to different applications. End users have to enter their username password multiple times. Now of course with single sign-on they enter it once and then during that session, they no longer need to authenticate again. The second thing I think that is important also security. It’s a secure product. We can make use of two factor authentication with the product and so from a security perspective, it gives us strong authentication. Our solution has to be basically 99.9% available, which means we have to have the highest availability out of the product that you can rarely from an IT system

We have deployed it in a very highly resilient and with a very strong PCM component. Ability to fail over within a datacenter and the possibility of failing over between countries and datacenters. It scales well, we have 200,000 users that's not simultaneous or you are all using it at once but certainly it scales events. There are advanced features that would mean that we need to look at scalability so it does authentication, does also authorization. If there is heavy authorization traffic then we really need to also look at how we scale that up. It can’t scale. It’s just a question of putting in more servers, putting in more infrastructure to allow it to scale.

To be honest, I don’t get involved with the operations side too much. I am an IT architect so I look at the overall architecture of the system and then how to introduce new requirements and how they can get fulfilled but my impression certainly is that the support is good. It has to be very good because we have a 99.99% availability, so if it wasn’t good we would’ve moved off it by now. I would say it is a relatively complex setup. We have a relatively complex environment so with all of the availability requirements we have, it is quite complex but having said that, it is no more complex than any other enterprise systems that has to be highly available.

I wouldn’t say it was overly complex but there's complexity in it. One of the reasons we are here today is also to understand what features there are in the future. I think for me as an architect, I look at what the emerging trends are. We have a lot of new requirements; mobility is a big one for us. Bring your own device, being able to authenticate on mobile devices securely, being able to make use of multiple applications right on that mobile device. Being able to integrate with containers for example Citrix, also with the changing old pricing models we have, a lot of outsourcing, a lot of software as a service, we need to be able to improve how we have authentication to the cloud, federation capabilities and that sort of thing. There is a lot that we can do to go forward.

At this point I'd rate it about 8/10. One of the biggest things is availability. Availability, scalability, you really have to make sure you understand the scale of the deployment and what your requirements are around availability. Certainly in our company it has to be the highest scale, highest availability. Don’t underestimate the amount of testing you have to do, the amount of stress testing, load testing, because this is critical infrastructure. This really is the front door to all the applications in the bank and if this goes down, the bank has stopped working. Quite simply you have to make sure that you do all of the testing required to make sure that product is absolutely rock solid.

I think it is very important to do your due diligence. You need to do your research into what is out there and what is best to meet your requirements. That said, I think there is nothing really that can replace doing a proof of concept. You have to do a proof of concept, because no matter what the vendor says, no matter what other people say other blogs or other reviews, your involvement is always going to be unique. There is always going to be something that you need that maybe other people haven’t done before. Be that some authentication method, some authorization method, the number of people you have, your topology of your network.

There is always to be something. Take all of the other information in but you must verify yourself. I think you have to really understand supportability. Quality of the product, so you have to trust the quality of the development methods, the testing that it scales to how you wanted to scale that you’ve got examples of the product being deployed in similar types of organization, similar sizes, and similar industry is important. Yeah I think they are the main things really.

This is a web single sign-on product.

The solution is very stable.

It's simple to implement, and very easy to customize.

It's quite scalable.

The performance could be better.

The support could be faster. 

Sometimes when your customer has a legacy application and they want to make a single sign-on, you cannot do it with SiteMinder.

The solution doesn't support client-based Java. 

You do need to be pretty comfortable with the product in order to use it. 

The product needs to invest in enhancements. They are not innovating anything lately. The competition is beginning to pull ahead of them and they are getting left behind. 

The cost of the product is a bit high.

My team has been using the solution for eight or nine years. I've used the solution for 15 years or so. 

The solution is very stable. There are less bugs or glitches. 

We have four or five big clients that use the solution. 

The technical support could be faster. We're not 100% satisfied with their level of service. 

The support, in general, is an issue with Broadcom. With any product that Broadcom owns, the general problem is that they are unable to provide the right support. Luckily, SiteMinder is a very stable product. We rarely have issues.

It's not difficult, however, eventually, you need the right expertise to implement the solution. You need the right consultant who has knowledge of the applications, the knowledge surrounding security, and can handle in-depth logging processes that are taking place. Basically, you need the right people to implement it. It's not easy. I would prefer to have a consultant who has the development knowledge.

The size of the team you need to implement the product depends on the size and the scope of the project. For a simple two or three applications, we needed only one consultant to implement. However, if it is a massive implementation with multiple products, multiple web servers, web applications, et cetera, eventually its scope varies and timelines vary, and you will require a couple of engineers to implement it.

Clients need to pay for a partial license and a subscription license. 

The pricing is a bit high and they could make it more competitive.

I'd rate the solution at a nine out of ten.

I would recommend the solution to others. If they want to have a secure, stable solution for a single sign-on that supports Java, ASP. Net, and most of the web-based applications, I encourage them to go with this product. However, a company must make sure that they have the right people to implement it properly.

It provides the breadth and the width to provide solutions for the different kinds of technologies which we have. Stability is the most important thing for us. It just allows the user a simple, one way of authenticating. They really made life simple for the user and and the user experience has improved. The user doesn't have to memorize and retain many passwords. They provide a secure and an easy to use solution.

As we are moving in to the mobility space, this is where we really see SiteMinder and their other product really come together to provide a solution base to a different area where the IoT is coming, the different business communications are happening. All of those things require authentication and we really want to see this product grow into that role.

We have been using SiteMinder for the last 15 years and we have been very good and successful in implementing the solutions. The solutions have been working for us. We have not used up any of those solutions since 2001.

Regarding the implementation aspect of it, any Single Sign-On solution has multiple components to it. The client side solution has a required plug-in, which is very easy because the majority of the web servers which are out there, their support is always available and for any kind of a new web server comes in and then similarly on the back end side where the servers are really running and it is very easy to incorporate and adopt.

The solution is very stable. It is the most important thing because all of our applications use this product. If the solution goes down and the product doesn't work then we have a major outage in the company, so it is very, very important that any solution we use, not only is it ease of use, but also that it is important that the solution is stable, and it works the majority of the time. Of course, no software solution is 100%, but as long as it provides 99.9% availability, that's what we look for.

It's very scalable as a self service solution and you can add as many servers as you want, and as many locations as you want. There was a time that we had 20 million customers based on this one solution. It can support a variety of ways, but there is a number of applications, number of users. All of these things really provide very good and easy ways to scale without many changes to the environment.

The important thing is not only the scalability and availability, but also having a good partnership. When the problem comes up, how quickly can we can solve it? That's one of the best things what CA gives us. To establish a relationship which is based upon the partnership and they are there to help us whenever we have any problems.

They have a tier support model just like any company has, so depending upon the type of issues we are having we usually get a good response very quickly. A back end engineer on our case if this is going on a severity level one, then we get very good support immediately.

The product is 8-9/10. It's very high because of their availability and supportability on different web servers is very, very, highly ranked.

My advice and best practices is always engage with CA. Make sure that you're working and getting their input and to also see what their best solution is. They provide a very good partnership. They give you a suggestion and recommendation. You'll her from them - What is the right thing? What is the right solution? If you engage and build a good relationship you always have a good solution.

The advice is that whatever you are thinking of the product make sure you are talking to the right people. The majority of them are good people and they'll give you the right solution.

The most valuable feature is the flexibility of this product to integrate with any third-party components and platforms. Support for those is a really interesting feature.

It is a decent solution. We have been using it for our SSO API stuff. We also use it for implementing single sign-on across internet-facing applications.

One of the features that needs improvement is the capability of implementing single sign-on in cloud. As a client-server model, we depend on the IP addresses that break when we move into cloud, so more of a REST API approach is needed.

There are still areas in this product that need to be improved, as in every other product.

The newer releases are quite stable. We do come across some issues, but the release cycles are good and quite impressive.

Scalability is decent. We have been using it for a long time and we don't have any issues with the scalability part of it. It is quite scalable.

The technical support level varies from average to medium. We would like them to improve parts of their technical support so as to provide quicker and better solutions.

I wouldn’t blame the technical support team, as they need support from the engineers. There is need to provide more training to the technical staff in regards to the latest features.

We were using some other tool previously. At one point, a requirement came up for a more stable and enterprise-wide solution, so we decided to invest in the CA tool.

The setup was complex because we customized the entire implementation process. Although, I doubt any other customer would use it in a similar way.

I was not part of the discussion for shortlisting other vendors but I am aware that our company did perform some POCs and narrowed it down to CA SiteMinder.

It is a decent solution. CA is focusing on improving the stability of this product and their future roadmap looks quite promising as well. Companies should invest in this product and should think of it as a competitor.

When selecting a vendor, we focus more on the technology standpoint; how flexible the product is; how much customization we can do; the support availability.

We like the ease of implementation, integration, and the support matrix. Cookie provider helps us set host-based cookies and provides SSO across multiple domains. It provides restricted cookies as well.

It restricts cookie replacement and provides enhanced ones, so the applications are safer. Helps keep our data secure in a much better way without affecting user experience.

Better support. It would be great if they could move to the AWS model where we could open up a chat with the support person immediately instead of opening up a case. We’d love to see them implement screen sharing to expedite the support process.

10/10 - no issues.

I haven’t seen any performance problems with scaling or general performance ability, so maximum points there as well.

Not great. The first level of support is not up to the mark or able to understand the actual problem. It takes us time to explain the problem. Any time we open up a case we have to repeat the explanation of the problem 15 to 20 times until we get a response that is in line with what we are expecting.

The handoff isn’t good. Communication with the different support teams is a challenge, and we have to repeat every detail of the problem at every stage, which makes it not a great experience.

It was simple. Documentation has been more than satisfactory, and we’re happy with that. The changes are very well communicated. Even the point releases haven’t given us any problems.

It has all the features, and the CA roadmap has always been ahead of the competition. The only missing portion is documentation around global deployment. As companies are growing bigger and bigger, they’re thinking about global deployments, so we haven’t seen much talk around global deployments, and I haven’t seen any white papers.

The three security products perform different functions, but they are all part of the suite. SiteMinder is an industry leading solution as everyone is using it. The new offerings are simplified, which is good.

Besides that, other things are pretty much on par for the industry products out there. All the products have valuable features, but they’re similar with what’s out there.

We are using it for multi-factor authentication, and we are using it also for our identity management processes. Some of the tasks we have been doing for boarding, it's helped us meet requirements by having dual-factor authentication.

With CA Identity Manager, the integration support with other technologies is still not mature enough. CA IDM still has a lot of moving components. Oracle and SailPoint solutions are much simpler and robust, although we are using CA because we have licenses despite it needing to be simplified.

We're using this alongside IdentityMinder and RiskMinder.

I would rate the suite 4-5/10. SiteMinder is the most stable and is 7-8/10 rating. with the other ones, we’ve had problems, and they doesn’t really match our business needs. The other parts of the suite are lower.

I think for SiteMinder, we have a business need and we think it is scalable. For 2016, we'll increase our infrastructure. For the others, we are running them on a minimum hardware set.

We often use tech support when we get stuck in situations. We have less of a relationship with them because we escalate with partners and they provide us with support. If you just open a ticket directly with CA, the guy doesn’t have a solution. With the partners, there's always a good solution.

I started using it six years ago when it was very complex. Now they have given a lot of UI features and simplified it as well.

They are good from a cost standpoint. The price model offering is very comparative to other solutions. That is a positive.

We also looked at Oracle and SailPoint solutions. We looked for a solution that had good integration with other technologies in an enterprise organization. We also considered the simplicity of the product.

CA has a lot of servers, but it needs to be simplified to only two to three components. The SiteMinder solution is something that if my colleagues would like, I’d suggest that.

Other products I would say, go look out in the market. There are better solutions, and CA should look at Gartner’s Magic Quadrant and IDG. Look at the capabilities to see how they can bring those capabilities into their products, etc. It gives me the single sign-on between applications. On-boarding isn’t effort intensive. Those are good things.