An IdP/STS for SaaS providers, where the SaaS customer does his own user management?

(This question is not about programming, but about how to avoid doing any programming. Also, lots of terminology in here-- I'm assuming someone with an answer will already know what they mean.)

Background: I'm working on single sign-on in an environment with 'federated identity'. We have several products that are federation-aware (using, e.g., WS-Federation or SAML protocol, implemented with, e.g., WIF on .NET and Fedlet on Java), and they are offered to customers using a SaaS model. Many of those customers don't have their own store of usernames/passwords, so they will not run an "identity provider" themselves.

Question: Is there a product out there that

• can be installed at the SaaS provider;

• plays the role of an IdP/STS (i.e., identity provider in a federated envirome开发者_运维知识库nt) to the SaaS-provided applications;

• has its own username/password store, separately for each SaaS customer ("tenant");

• allows the SaaS customer to do his own user management, without requiring assistance from the SaaS provider.

(We could build this ourselves, e.g., as a custom STS on top of WIF with user admin screens, but we're trying to avoid that. It's not really our core business.)

---

Have you had a look at Google app engine ?
They support SAML, so you can use them as your Idp.

---

So we did not find a product that fulfills all these requirements.

What we decided on was to use AD FS 2.0 as the SaaS IdP/STS, store usernames/passwords in AD (making the SaaS customer name part of the username), and customize the AD FS sign-in page linked to a custom web application for user management and user self-service.