Cirrus Identity
Cloud Identity Management for Education and Research

Cirrus Identity’s journey began while Dedra Chamberlin worked at the University of California. She ran the identity management program as the Deputy Director for Identity Management at UC Berkeley and San Francisco. One of the biggest pain points that she faced stemmed from providing access to users who needed to log in occasionally to digital services provided by the university, but didn’t really qualify for an enterprise-level user account. In the university, typically enterprise users are students, faculty, and staff, but as universities moved their services to the web, they had a growing number of external users who needed access, such as applicants, parents, alumni, and continuing education students.

To address this pain point, Dedra, founded Cirrus Identity—steering the company as its CEO today—with a focus on making guest account access easier at universities. One of the ways the company achieves this is by integrating external login with the campuses’ single sign-on solutions. This approach makes digital services accessible either from the campus identity provider or through external accounts such as Google and Microsoft. Today, one of Cirrus Identity’s main value propositions is to streamline access to digital services for its clients’ customers. In an interview with CIO Applications, Dedra elaborates on why Cirrus Identity is the Swiss Army knife of cloud identity management.

Please elaborate on some of the pain-points in the Education landscape, and how does Cirrus Identity address them?

In many universities, typical alumni will graduate and then have to go through a really cumbersome re-registration process to sign up for alumni services which can be discouraging and too many alumni give up. We’re making it easier for the alumni and also the university’s IT team. Through our solution, alumni engagement goes up because they don’t have to create and remember a new user account. And the IT team does not have to maintain a custom-coded guest account system, which can be very costly to manage. We deliver built-in e-mail invitation and account linking services which take away the development and maintenance requirements from the university’s IT staff.

We have evolved over the years to offer a suite of solutions to provide a comprehensive “external user account” solution for the universities. The Cirrus Gateway is our most popular module, and enables easy integration of social identities, like Google, LinkedIn, and Facebook with enterprise single sign-on solutions. The Gateway eliminates the need for external users (like applicants, alumni, parents, etc) to create new user names and passwords. This reduces user frustration and common support tickets for login problems.

One of our most significant competitive advantages in this market is everyone on my leadership team has worked for many years in the field of higher education identity management. By leveraging our experience, another popular solution that we have developed is the Federation Bridge. The higher education space has adopted multilateral federation models, making it easy to share an online service with people from multiple institutions. Many online services don’t support multiple identity providers in their single sign-on configuration, and that’s what we can we deliver through our Identity Provider Proxy module.

Further, we also provide a Bridge service makes it easy to link an existing enterprise identity management solution, like Azure Active Directory or Okta, to the InCommon and eduGAIN federation metadata.

Can you elaborate on the security aspect of your solution?

One of the taglines that we often use to describe our company is that we are the Swiss Army knife of digital identity management. And that is because we offer solutions that can typically fill important gaps in institutions’ enterprise identity strategy. When it comes to security, we follow all commercial best practices for securing our services. We have documented our security practices in the Higher Education Cloud Ven Assessment tool standards (HECVAT), to make it easier for our clients to evaluate our security practices.

How does Cirrus Identity’s make it seamless for universities to manage identity access and control?

Campuses often start out with one use case for external users, and then expand our service to cover other integration challenges later. For example, Carnegie Mellon initially used our Invitation, Account Linking, Gateway, and Proxy solutions to enable better access for parents. Students “invite” parents to register for login with a social identity provider. They later expanded their integration to include incoming student applicants. Similarly, the University of Michigan launched a Cirrus integration to streamline alumni access to their Salesforce communities for alumni, and now they are working with us on an integration to their Canvas LMS. Ultimately, our goal is to help our customers enable seamless access for users as they transition from “external” status, to having an enterprise account, and back to external login again.

Can you please walk us through the different modules that Cirrus Identity delivers?

Our solutions are designed to be the handy tools for managing critical identity integrations. Cirrus Identity modules run in the cloud (IDaaS), so the deployment becomes like configuration instead of installation. Our Identity solutions consist of two main categories of technology. For the authentication engine, we leverage an open-source project called SimpleSAMLphp, and we actively contribute to the project.

The other big component of our technology is an administrative console that gives the universities’ IT teams easy tools for managing the integration of different identity providers and service providers. We eliminate the need for custom coding and associated headache when integrating Service Providers and Identity Providers, including social identity providers.

Tell us about the initial approach that you undertake to engage with your clients.

We typically start our conversation with a potential customers by discussing use cases. We demonstrate a similar use case that we have already implemented at another University. During the onboarding and the initial integration phase, we set up meetings with them every two weeks that include the customer success and necessary engineering team from our side as well as from the campus side. Once services go live, we typically meet less frequently, until a new use case emerges and we set up biweekly calls again until go-live. We’ve had many customers come back after their initial subscription to add additional modules as they’ve expanded their use of our services on their campus.

Many campuses have a huge strategic priority around the student experience, and they try to make that as positive as possible. And one of the big value propositions for our services is that we streamline access throughout the entire identity lifecycle – from applicant, to registered student, to alumni.

What does the future hold for Cirrus Identity?

In terms of expansion, we are always adding new features to our existing product and will add additional modules in the future. Much of our development and expansion is based on what our current customers are requesting and what we hear about from the market. We will be building in additional self-service components to our solution that will also enhance users’ ability to see the data they have shared and basically manage their own data privacy settings effectively.

We’re also looking at expanding to other geographical areas such as Latin America in the coming year, and we’re beginning to partner with key organizations in that area.