Migration of user authentication from on-premise to the cloud

1 . An apparatus comprising:

a processor; and

a memory on which is stored machine-readable instructions that when executed by the processor, cause the processor to:

identify configuration information to be used by an on-premise access management service to provide authentication services to applications by users;

transform the identified configuration information into a transformed set of configuration information to be used by a cloud-based access management service to provide authentication services to the applications by users;

store the transformed set of configuration information for use by the cloud-based access management service to provide authentication services to the applications by users to migrate authentication of the users from the on-premise access management service to the cloud-based access management service; and

for each of the applications,

determine whether a configuration template for the application has been generated; and

based on a determination that a configuration template for the application has been generated, use the configuration template for the application to migrate management of access to the application from the on-premise access management service to the cloud-based access management service.

2 . The apparatus of claim 1 , wherein the on-premise access management service comprises an organization specific system that is to provide users with single sign-on access to the applications and wherein the cloud-based access management service comprises a multi-tenant system that is to provide users in multiple organizations with respective single sign-on access to respective applications.

3 . The apparatus of claim 1 , wherein the instructions cause the processor to:

migrate authentication of the users from the on-premise access management service to the cloud-based access management service.

4 . The apparatus of claim 1 , wherein the configuration information comprises endpoints that provide access to single sign-on functionalities of the on-premise access management service and claims that include statements about users to be used by the premise access management service in authenticating the users.

5 . The apparatus of claim 1 , wherein the instructions cause the processor to:

identify the applications to which the on-premise access management service is to provide authentication services to the users;

determine metrics associated with the identified applications;

determine priorities of the applications based on the determined metrics; and

transform the identified configuration information in an order according to the determined priorities of the applications to which the configuration information correspond.

6 . The apparatus of claim 1 , wherein the instructions cause the processor to:

identify the applications to which the on-premise access management service is to provide authentication services to the users; and

determine, for each of a plurality of applications, whether authentication of access to the application is ready to be migrated.

7 . The apparatus of claim 6 , wherein the instructions cause the processor to:

for the applications for which authentication of access to the applications are determined to be ready to be migrated, transform the configuration information corresponding to the applications; and

for the applications for which authentication of access to the applications are determined to not be ready to be migrated, output an indication that rules and/or settings of the applications are to be reviewed and/or fixed.

8 . The apparatus of claim 7 , wherein, to determine, for each of a plurality of applications, whether authentication of access to the application is ready to be migrated, the instructions cause the processor to:

perform configuration tests on the rules and/or settings of the application to determine whether authentication of access to the application is ready to be migrated.

9 . A method comprising:

identifying, by a processor, configuration information that an on-premise access management service is to use to provide authentication services to applications by users, the configuration information comprising endpoints and claims;

transforming, by the processor, the identified configuration information into a transformed set of configuration information that a cloud-based access management service is to use to provide authentication services to the applications by the users;

storing, by the processor, the transformed set of configuration information for use by the cloud-based access management service in providing authentication services to the applications by the users; and

for each of the applications,

determining whether a configuration template for the application has been generated;

based on a determination that a configuration template for the application has been generated, using the configuration template for the application to migrate management of access to the application from the on-premise access management service to the cloud-based access management service; and

based on a determination that a configuration template for the application has not been generated, generating a new configuration template based on information received from a user.

10 . The method of claim 9 , wherein the on-premise access management service comprises an organization specific system that is to provide users with single sign-on access to the applications and wherein the cloud-based access management service comprises a multi-tenant system that is to provide users in multiple organizations with respective single sign-on access to respective applications.

11 . The method of claim 9 , further comprising:

receiving an instruction to migrate authentication of the users from the on-premise access management service to the cloud-based access management service.

12 . The method of claim 11 , further comprising:

causing the authentication of the users to be migrated from the on-premise access management service to the cloud-based access management service based on receipt of the instruction.

13 . The method of claim 9 , further comprising:

identifying the applications to which the on-premise access management service is to provide authentication services to the users;

determining metrics associated with the identified applications;

determining priorities of the applications based on the determined metrics; and

transforming the identified configuration information in an order according to the determined priorities of the applications to which the configuration information correspond.

14 . The method of claim 9 , further comprising:

identifying the applications to which the on-premise access management service is to provide authentication services to the users;

determining, for each of a plurality of applications, whether authentication of access to the application is ready to be migrated.

15 . The method of claim 14 , further comprising:

for the applications for which authentication of access to the applications are determined to be ready to be migrated, transforming the configuration information corresponding to the applications; and

for the applications for which authentication of access to the applications are determined to not be ready to be migrated, outputting an indication that rules and/or settings of the applications are to be reviewed and/or fixed.

16 . The method of claim 15 , wherein determining, for each of a plurality of applications, whether authentication of access to the application is ready to be migrated, further comprises performing configuration tests on the rules and/or settings of the application to determine whether authentication of access to the application is ready to be migrated.

17 . A non-transitory computer-readable medium on which is stored computer-readable instructions that when executed by a processor, cause the processor to:

identify applications to which an on-premise access management service is to provide single sign-on authentication services to a plurality of users;

identify configuration information that the on-premise access management service is to use to provide the plurality of users with the single sign-on authentication services to the applications;

transform the identified configuration information into a transformed set of configuration information that a cloud-based access management service is to use to provide the plurality of users with single sign-on authentication services to the applications;

store the transformed set of configuration information for use by the cloud- based access management service in providing the plurality of users with the single sign-on authentication services to the applications;

determine metrics associated with the identified applications;

determine priorities of the applications based on the determined metrics; and

transform the identified configuration information in an order according to the determined priorities of the applications to which the configuration information correspond.

18 . The non-transitory computer-readable medium of claim 17 , wherein the instructions further cause the processor to:

receive an instruction to migrate authentication of the plurality of users from the on-premise access management service to the cloud-based access management service; and

cause the authentication of the plurality of users to be migrated from the on-premise access management service to the cloud-based access management service based on receipt of the instruction.

19 . The non-transitory computer-readable medium of claim 17 , wherein the instructions further cause the processor to:

perform configuration tests on rules and/or settings of the identified applications to determine which of the applications are ready to be migrated.

20 . The non-transitory computer-readable medium of claim 19 , wherein the instructions further cause the processor to:

for the applications for which authentication of access to the applications are determined to be ready to be migrated, transform the configuration information corresponding to the applications; and

for the applications for which authentication of access to the applications are determined to not be ready to be migrated, output an indication that the rules and/or settings of the applications are to be reviewed and/or fixed.