Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Main things to consider when building an app for business/enterprise?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 132 posts

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#101

Post by braveyellowtoad »

mooreds wrote: post #92
pclmulqdq wrote: post #87

Earlier quoted context omitted.

I'm not entirely sure I agree with this - most auth providers are very expensive, and if you don't need the full-featured offering, you are way overpaying for the engineering time to build your replacement. If you need all the features, it's a good deal, but you rarely do unless you are building something like Notion or Jira. Open source components (Ory) can do the basic cryptography, and if you go completely from sc…

> most auth providers are very expensive Some are, sure, but there are many that are not. FusionAuth (again, I'm an employee) has a free community edition ( https://fusionauth.io/pricing?step=plan&hosting=self-hosting ) if you run it yourself with no limits on MAUs, SAML connections, tenants or users. Of course, we have plans that cost money because, hey, we all like to eat. Auth0 has a basic plan that is free for 7k…

Thanks for sharing. Do you know of any auth providers that charge based on auth event (login / logout / password change / etc) rather than per user?

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#102

Post by dieselgate »

twojacobtwo wrote: post #90
dieselgate wrote: post #73

Earlier quoted context omitted.

I wasn't familiar with the acronym RBAC (but certainly familiar with the concept) until web searching for it. First link was from solarwinds.. nope, found an okta link.. yep! Thanks for the well thought out list this was helpful

Since I had the same experience just now, it seems useful to post the answer here. In computer systems security, role-based access control (RBAC) or role-based security is an approach to restricting system access to authorized users. It is an approach to implement mandatory access control (MAC) or discretionary access control (DAC). https://en.m.wikipedia.org/wiki/Role-based_access_control

Thanks for the call out

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#103

Post by x0x0 »

moneywoes wrote: post #95
x0x0 wrote: post #53

Earlier quoted context omitted.

Background: cofounded an enterprise saas company. I like this coverage of tech, though it's missing soc2 which will be required. And 27001 eventually. I disagree on making it easy for admins to add users. Just don't: rather, implement (a bit of) scim or jit user creation with the idp flows. The big thing it's missing is sales. This software is sold not bought. In any sales process with 3 different constituencies (use…

How did you build your sales skills and get those first 10 customers? Like I want to Build a property saas should I start prospecting first

> How did you build your sales skills

I didn't. I paired w/ a cofounder that is a fantastic salesperson. He ran gtm, I ran prodeng.

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#104

Post by mooreds »

braveyellowtoad wrote: post #101
mooreds wrote: post #92

Earlier quoted context omitted.

> most auth providers are very expensive Some are, sure, but there are many that are not. FusionAuth (again, I'm an employee) has a free community edition ( https://fusionauth.io/pricing?step=plan&hosting=self-hosting ) if you run it yourself with no limits on MAUs, SAML connections, tenants or users. Of course, we have plans that cost money because, hey, we all like to eat. Auth0 has a basic plan that is free for 7k…

Thanks for sharing. Do you know of any auth providers that charge based on auth event (login / logout / password change / etc) rather than per user?

The big cloud providers have substantial free tiers (50k MAUs). Cognito, Firebase and Azure AD B2C all have a similar free tier. After you go through the free tier, you pay per MAU ($0.005 per MAU, according to https://aws.amazon.com/cognito/pricing/ , I think similar for the other providers. For smaller players, I think Stytch is 10c/MAU/month, where an MAU is any interaction with the Stytch service (login in all the many forms). https://stytch.com/pricing has more.

You'll have to dig a bit deeper into each pricing page to determine what actions make a user 'active'. I'm not aware of anyone who does MAU calculations on a day to day basis; monthly rollups are the standard.

Some folks charge per MAU (FusionAuth does) but in a band (the first 10k MAUs for a FusionAuth paid version are all one price).

HTH.

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#105

Post by worewood »

Performance and reliability are things sadly missing from corporate apps. You don't need CDNs, caching servers and all that good stuff; if a screen is taking 3secs instead of 1sec to load, no problem. No problem it being web-based instead of native, either.

But I've seen apps out there where a screen takes 10+ seconds to load, and often that fails and you have to try again! That is absolutely unacceptable.

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#106

Post by braveyellowtoad »

mooreds wrote: post #104
braveyellowtoad wrote: post #101

Earlier quoted context omitted.

Thanks for sharing. Do you know of any auth providers that charge based on auth event (login / logout / password change / etc) rather than per user?

The big cloud providers have substantial free tiers (50k MAUs). Cognito, Firebase and Azure AD B2C all have a similar free tier. After you go through the free tier, you pay per MAU ($0.005 per MAU, according to https://aws.amazon.com/cognito/pricing/ , I think similar for the other providers. For smaller players, I think Stytch is 10c/MAU/month, where an MAU is any interaction with the Stytch service (login in all th…

Thank you

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#107

Post by akajla »

Disclaimer: I'm the founder of an authorization company [1] & previously worked at a large, enterprise/SaaS company so basing my comment on my experiences.

Your considerations and things you need to worry about will vary greatly based on your stage (early-stage startup, late-stage startup, public, etc.), market (fintech, health-tech, etc.) and customers you target (early-stage startups or bigger, Fortune 100 types). As others have stated, it's important to figure out the go to market strategy first by talking to potential customers before building anything.

Assuming you've pressure-tested your idea and built an MVP/early product that shows some traction, you'll want to take care of app + data security basics (authn, authz). Guides like the OWASP Top 10 and your future customers will guide you in the right direction here.

On the authz side (since that's my area of focus) - multiple comments have mentioned RBAC (role based access control) which most enterprise/SaaS companies end up implementing but it's rarely where authz stops. As products evolve and grow more complex over time, you'll need to implement some form of fine-grained (object/resource based) authorization (ex. attribute based, relationship based access control) as well as auditing capabilities, all of which customers will ask for at some point.

In an ideal world, you'd have all of these capabilities already built but that's rarely the case. In reality, you prioritize and implement these over time based on security needs, risk and customer requirements.

[1] https://warrant.dev/

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#108

Post by akajla »

sebmellen wrote: post #89
mooreds wrote: post #84

Earlier quoted context omitted.

Do you mean to use Ory Kratos in a self-hosted manner? From a brief look it seems like you aren't rolling your own auth when you use this, but rather integrating it into your application. What am I missing?

Kratos is not a complete Auth solution - if you self host you still need to write your own UI. We built another layer over it to handle RBAC and organization management. But at least Kratos covers all the complex crypto and security items related to authentication (not authorization, which I consider to be a part of “auth” writ large).

Building and maintaining UIs for RBAC and org management (including self-service, user-facing UIs) isn't trivial. That's why we built it into Warrant. We handle basic authz schemes like RBAC as well as fine-grained authz: https://blog.warrant.dev/introducing-the-self-service-dashbo...

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#109

Post by pclmulqdq »

mooreds wrote: post #92
pclmulqdq wrote: post #87

Earlier quoted context omitted.

I'm not entirely sure I agree with this - most auth providers are very expensive, and if you don't need the full-featured offering, you are way overpaying for the engineering time to build your replacement. If you need all the features, it's a good deal, but you rarely do unless you are building something like Notion or Jira. Open source components (Ory) can do the basic cryptography, and if you go completely from sc…

> most auth providers are very expensive Some are, sure, but there are many that are not. FusionAuth (again, I'm an employee) has a free community edition ( https://fusionauth.io/pricing?step=plan&hosting=self-hosting ) if you run it yourself with no limits on MAUs, SAML connections, tenants or users. Of course, we have plans that cost money because, hey, we all like to eat. Auth0 has a basic plan that is free for 7k…

I think you're assuming that scratch coding is slower than integrating an OSS you don't know. When I was thinking about this for one project, it came close enough that I rolled my own basic auth system according to the NIST recommendations and it definitely took less time than integrating something that I didn't know (and accepting all the unknown bugs that are inevitably there).

I also don't buy the argument "don't waste time on something that is not a differentiator" - I'm going to spend time on it anyway, so I might as well spend the time in the most productive way possible. Also, I guarantee that your solution isn't bug-free, and eventually one of them is going to bite me, so that also factors into the decision about time.

The basic version of authentication is actually really simple. When you add SSO, RBAC, Oauth2, ACLs, and other stuff, it gets really complicated. People should make intelligent decisions about what they want to do here rather than just using a provider.

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#110

Post by mooreds »

akajla wrote: post #108
sebmellen wrote: post #89

Earlier quoted context omitted.

Kratos is not a complete Auth solution - if you self host you still need to write your own UI. We built another layer over it to handle RBAC and organization management. But at least Kratos covers all the complex crypto and security items related to authentication (not authorization, which I consider to be a part of “auth” writ large).

Building and maintaining UIs for RBAC and org management (including self-service, user-facing UIs) isn't trivial. That's why we built it into Warrant. We handle basic authz schemes like RBAC as well as fine-grained authz: https://blog.warrant.dev/introducing-the-self-service-dashbo...

That's cool. FusionAuth has a self service function: https://fusionauth.io/docs/v1/tech/account-management/ but it is limited to user profile data, rather than roles and permissions.

How do you prevent a user from assigning themselves roles they shouldn't? Is there some kind of cage preventing escalation?

Post reply on HN