Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The SSO Wall of Shame

sso.tax

Post reply on HN
Print view View original

31–40 of 44 posts

Re: The SSO Wall of Shame

#31

Post by dmm »

spacemanmatt wrote: post #23
GekkePrutser wrote: post #21

Earlier quoted context omitted.

I'd love it even at home but there seem to be no good FOSS IDP systems. I wish.... At work we use PingID which is not very expensive compared to industry standard ones like Okta. But it's very poor in my opinion. It seems they're always lagging years behind competitors in terms of features.

I'm pretty close to deploying Keycloak at home

I'm thinking about doing the same thing. I just found out about "authenticating proxies", like traefik-forward-auth, and I'm hoping something like that plus keycloak would allow me to easily add 2fa/webauthn support to a couple of applications I host at home.

[0] https://github.com/mesosphere/traefik-forward-auth [1] https://brianturchyn.net/traefik-forwardauth-support-with-ke...

Re: The SSO Wall of Shame

#32

Post by craigkerstiens »

We were very explicit in our decision for Crunchy Bridge [1] to not require an enterprise account or upcharge to support SSO enforcement [2] for teams. As a database provider you're trusting us with your data. SSO is a good security feature, you shouldn't have to pay extra for good security. In our mind it's likely to save us from you having a bad day which also helps us as the data provider.

1. https://www.crunchydata.com/products/crunchy-bridge/

2. https://docs.crunchybridge.com/concepts/single-sign-on/

Re: The SSO Wall of Shame

#33

Post by spacemanmatt »

dmm wrote: post #31
spacemanmatt wrote: post #23

Earlier quoted context omitted.

I'm pretty close to deploying Keycloak at home

I'm thinking about doing the same thing. I just found out about "authenticating proxies", like traefik-forward-auth, and I'm hoping something like that plus keycloak would allow me to easily add 2fa/webauthn support to a couple of applications I host at home. [0] https://github.com/mesosphere/traefik-forward-auth [1] https://brianturchyn.net/traefik-forwardauth-support-with-ke...

When I looked around, Keycloak stood out for being a credible enterprise OAUTH2 server with a free edition truly aimed at making me like the product as a user rather than aimed at roping me into eventually purchasing a support contract or buying premium extensions.

The most recent version of Keycloak jettisons JBoss in favor of Quarkus and everything about it is roundly better as a result. I'd been running a version from 2018 until this month!

Re: The SSO Wall of Shame

#34

Post by GekkePrutser »

dijit wrote: post #25
GekkePrutser wrote: post #21

Earlier quoted context omitted.

I'd love it even at home but there seem to be no good FOSS IDP systems. I wish.... At work we use PingID which is not very expensive compared to industry standard ones like Okta. But it's very poor in my opinion. It seems they're always lagging years behind competitors in terms of features.

for an iDP there's always Keycloak and Authentik; both incredibly viable. The problem is not the hosting of it; it's that nothing will integrate with your iDP, so you can't use your personal keycloak/traefik instance with, say, your github or gitlab profile. Mozilla Persona was a good idea of handling this[0] but sadly was retired. [0]: https://en.wikipedia.org/wiki/Mozilla_Persona

PS: I did look exclusively for stuff that supported full passwordless Fido2 though, and perhaps this didn't at the time.

Re: The SSO Wall of Shame

#35

Post by jbboehr »

mooreds wrote: post #16
jabroni_salad wrote: post #15

Earlier quoted context omitted.

If you are just testing, grab an AzureAD development account. If you want something more permanant Keycloak is probably your best bet. I'm not aware of any other truly free ones

There are a couple of other free options I'm aware of. * FusionAuth has a community edition which is free as long as you host it yourself and comply with the license ( https://fusionauth.io/license-faq#3 ). Free as in beer, at least. (Full disclosure, I work for FusionAuth.) Here's our SSO guide: https://fusionauth.io/docs/v1/tech/guides/single-sign-on * If you want a SaaS solution, Cognito is an option, as is Azure…

> The source code for the fusionauth-app bundle and all closed source libraries owned by FusionAuth cannot be decompiled or reverse engineered. This prevents companies from forking FusionAuth and creating their own solution to sell to their customers (i.e. like Amazon has done with ElasticSearch).

Is AGPL or one of those new licenses like the BSL not sufficient to prevent this sort of thing?

Re: The SSO Wall of Shame

#36

Post by ajcoll5 »

zrail wrote: post #14

This page underestimates how much it costs to handle SSO as a service provider. Companies that want it are almost always large enough to demand custom contracts, procurement discounts, custom integration work (SSO beyond the big few providers almost always requires custom work), meetings, and security attestations.

I see similar sentiments whenever SSOTax is mentioned. If providing it is a support burden, why not provide an unsupported standard self service SAML 2 integration that is validated against the top 2-3 identity providers, and make clear if the customer needs assistance with the integration or something custom it's $X hourly rate?

Why must everyone suffer the outrageous 'tax' if most are just using the same top 2-3 providers anyway.

Re: The SSO Wall of Shame

#37

Post by ryancp »

go_prodev wrote: post #3

Is there an easy way to get started with SSO on a SAAS app? (Without paying per user on Okta/Auth0) I'm currently using Firebase which supports sign-in with Microsoft, but not sure if that's technically the same as SSO.

I am a big fan of Keycloak as it’s been mentioned a few times in previous comments. Maybe this could help someone interested in implementing SSO, but currently working on a full stack starter kit that has Keycloak support/integration included: https://appcket.org.

Re: The SSO Wall of Shame

#39

Post by deepakprab »

This is one of our motivations at BoxyHQ, to commoditize enterprise-readiness features. SAML SSO should be available on all plans without crazy markups on the pricing. Vendors should separate their core enterprise features from undifferentiated ones like SSO.

Re: The SSO Wall of Shame

#40

Post by billdietrich1 »

As a normal home user, I avoid SSO like the plague. I don't want to wake up one day to find that Google has decided I'm a spammer or something, and turned off my Google account, thus disabling my login to 30 other sites.
Post reply on HN