Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Okta to Acquire Auth0 for $6.5B

cnbc.com

Post reply on HN
Print view View original

311–320 of 326 posts

Re: Okta to Acquire Auth0 for $6.5B

#311

Post by mooreds »

advaitruia wrote: post #262
chrisbuc wrote: post #249

Earlier quoted context omitted.

I'm just starting a new side project, and have looked at Keycloak and fusionauth. Fusionauth has a free offering (ie, self hosted), and takes a minute to install and run. I like it a lot and am going forward with it for testing. You won't see a login with fusionauth button, you'll just see a login button on my website, which might give you Google, github,LinkedIn logins etc depending on what I choose.

Depending on what set of features you need, it may make sense to also have a look at SuperTokens.io. Probably not as mature but we're open source and stronger with customization of the end user experience (frontend stuff), support and ease of implemenetation.

> stronger with customization of the end user experience

I might say "a different approach" :) I appreciate SuperToken's SPA first stance, but FusionAuth is pretty darn customizable too: https://fusionauth.io/docs/v1/tech/themes/

Re: Okta to Acquire Auth0 for $6.5B

#312

Post by DaiPlusPlus »

oftenwrong wrote: post #277
DaiPlusPlus wrote: post #103

Earlier quoted context omitted.

The idea of outsourced identity is just so contradictory it makes my blood pressure shoot up when people sincerely suggest it. I'll make an exception for Office 365 / AAD when an organization has already got their userbase added, but after that I'd wager if an org is big enough to need their own federated authX, then they're big enough to deploy IdentityServer and be done with it.

That's a bad wager to make. In B2B it's not unusual for small, under-resourced companies to have big customers that all require an integration with their own identity solutions.

That’s my point: IdentityServer (for example) is what enables any org capable of running a website themselves to integrate with other OIDC-conformant identity solutions via federation without having to cede any control over their identity system.

A good business case is a where a company (or public department) outsources their identity system to a company that doesn't have a 24/7 emergency phone line and people can't login and it's a business emergency - but I recognize this scenario is the same as "outsourcing is cheaper than in-sourcing, but outsourcing with the same level of quality and service as in-sourcing costs more than in-sourcing". YMMV.

Re: Okta to Acquire Auth0 for $6.5B

#313

Post by jrockway »

cdcarter wrote: post #305
jrockway wrote: post #204

Earlier quoted context omitted.

I was thinking very seriously about starting this company. There were some details I could never work out, and then Covid hit, so I didn't pursue it. My thoughts are: 1) One login per day per person is the maximum number of times I would ever consider asking for authentication. This is where OAuth fails; you visit an app that wants you to authenticate, but you don't get automatically logged in. You have to click at l…

> There is no standard, really, for identity aware proxies, and therefore no way for an app to recognize a standard token. How crazy is using the HTTP REMOTE_USER header for this?

It's fine, but you need network layer authentication and authorization. You don't want someone with network access to be able to act as any user -- i.e `kubectl port-forward important-app 80; curl -H "Remote-User: the-ceo@you.io" -X DELETE localhost/fire-all-employees`

So you need some way for important-app to be able to recognize that the remote-user header is valid. You can use mTLS and make important-app reject connections from anything that doesn't present your proxy's client certificate. You can sign the header. The header signing is pretty popular; google's Identity Aware Proxy sends a JWT there.

I have written an auth system that's done this twice. For the first iteration I used JWT. For jsso2 I use a PASETO-signed protocol buffer. Neither of these implementations has any support in the wild, so whatever you choose, you will be modifying the code of every app you run.

There is some support in the open-source world for your suggestion; there are many pieces of OSS that support a raw username in a header. Grafana does, Dex does (allowing you to pretend this is all OIDC for apps that don't support headers). But... it's pretty insecure. It means that you trust anyone who can run apps in production or access the network to act as any human user. No serious company would accept that; you can't let random engineers pretend to be the CEO in the HR system.

(That's another argument against self-hosting auth; insider risk is higher.)

Re: Okta to Acquire Auth0 for $6.5B

#314

Post by mooreds »

kenm47 wrote: post #75
andrew_ wrote: post #50

I hope this gives rise to another, smaller viable party outside of Amazon, Google, and Microsoft. Perhaps I'm jaded, perhaps hopelessly biased - but I can only see this as a net negative. Okta's open source packages receive a pitiful amount of attention (for example: https://github.com/okta/okta-oidc-js/issues?q=is%3Aissue+is%... ) with forks almost becoming a requirement. Auth0 by contrast has been "on the ball" for…

Have you heard of https://fusionauth.io/ ? I'm not a user of the product, but I know some of the folks behind it. Might be time for them to shine here.

We wrote a little blog post congratulating Okta and Auth0 on the acquisition:

https://fusionauth.io/blog/2021/03/04/congrats-auth0-okta-ac...

Re: Okta to Acquire Auth0 for $6.5B

#315

Post by sk5t »

TruthWillHurt wrote: post #173
omni wrote: post #111

Earlier quoted context omitted.

Check out Auth0's pricing page and it might start to make sense to you, they're outrageously expensive

Not more expensive than Looker at ~$6000pcm. Also Looker is category leader whereas Auth0 is struggling to compete against cloud-provider supplied solutions (Cognito/Google Auth).

If I recall okta’s monthly minimum is about 3k.

Re: Okta to Acquire Auth0 for $6.5B

#316

Post by death_by_ppt »

nl wrote: post #310
death_by_ppt wrote: post #308

Earlier quoted context omitted.

I think you quoted the wrong number for Okta's revenue. The first hit on Google said: > Okta revenue for the twelve months ending October 31, 2020 was $768M, a 43.77% increase year-over-year. Okta annual revenue for 2020 was $586M, a 46.79% increase from 2019.

I was quoting 2020 financial year numbers. As per your quote: "Okta annual revenue for 2020 was $586M"

I see. That's for FY2020, which was from Feb 2019-Jan 2020. So, it's from 12 months ago.

For FY2021 (that just ended: Feb 2020-Jan 2021), revenue was $835 million, an increase of 43% year-over-year.

Re: Okta to Acquire Auth0 for $6.5B

#317

Post by robotdan »

neom wrote: post #116
robotdan wrote: post #88

Earlier quoted context omitted.

Thanks for the mention. We already do see quite a few Auth0 converts. I expect to gain a lot of new customers as a result of this merger in the coming months. No complaints here.

Hey Dan, curious: why it's so difficult to figure out who is behind the company from the website?

To add to this... not trying to hide anything on purpose. :-) https://github.com/robotdan https://www.linkedin.com/in/robotdan/

Re: Okta to Acquire Auth0 for $6.5B

#318

Post by EtienneK »

skeeter2020 wrote: post #300
ForHackernews wrote: post #253

Earlier quoted context omitted.

https://www.keycloak.org/ is another open source option. Compared to other choices, it's more mature and well-vetted because it forms the upstream for RedHat's SSO offering. On the other hand, it's a big monolithic Java app, but they are making some moves to be more CNF-friendly: https://www.keycloak.org/2020/12/first-keycloak-x-release.ad...

If you are going to use keycloak it's worth making sure their mental model matches your own. Specifically we had issues with our model of multi-tennacy, each in their own realm vs. the keycloak idea of multiple tennants in a single realm. It caused some large performance and management issues.

Can you please share where you heard the Keycloak preferred way for MT is multiple tenants per realm? I have never seen this before.

Re: Okta to Acquire Auth0 for $6.5B

#320

Post by tor291674 »

manigandham wrote: post #174
vwpolo3 wrote: post #113

Earlier quoted context omitted.

There are already true open source alternatives on the horizon such as https://github.com/ory It is about time for a new generation of identity systems in my opinion. This acquisition shows the risk of centralized, vendor locked-in services.

Also https://identityserver.io/

They just went private and you need to pay $12,000/year for unlimited clients.
Post reply on HN