I once had to implement an authentication feature for a Chrome extension through Cognito with Google Workspace accounts via OAuth2 or MS accounts via SAML as IdPs.
That made me want to die.
Just understanding what I want to do or have to do was unbelievably hard, and probably I still don't understand what I did honestly.
Launch HN: SSOReady (YC W24) – Making SAML SSO painless and open source
61–70 of 101 posts
Re: Launch HN: SSOReady (YC W24) – Making SAML SSO painless and open source
#62These days, I feel like this biggest obstacle with SAML is integrating with SaaS products. I've been in many situations where it requires back and forth emails to a support team. I've been handed a literal 204 page PDF on integrating with one vendor's SSO setup (the entire document was literally just for their SSO integration, nothing else). Attribute mappings are still a mess. It's wild how poor the experience still…
SSO support took up well over 50% of our engineering teams customer support time.
One of the biggest challenges is our users tended to need to pull in a different department, that actually owned the SSO system. They had little incentive to hustle to get things to work, so there’s tickets would often drag on for ages.
We’d loom bad because we’d need certain information from our customer.
Re: Launch HN: SSOReady (YC W24) – Making SAML SSO painless and open source
#63SSOReady doesn't appear to support multilateral identity federation, which makes this DOA as far as I'm concerned.
I don't see how a proprietary authentication proxy atop a partial implementation of a SAML service provider addresses problems with enterprise SSO, which I'll wholeheartedly agree is just too goddamn hard.
The open source community doesn't need yet another open core project, for that matter.
Re: Launch HN: SSOReady (YC W24) – Making SAML SSO painless and open source
#64Congrats on launching! SAML is going to be around forever (even though the stadnard is no longer being updated[0]) so it's good for folks to have more options.
0: https://lists.oasis-open.org/archives/security-services/2023...
Re: Launch HN: SSOReady (YC W24) – Making SAML SSO painless and open source
#65Hi Ulysse, this is incredibly timely as we are looking at a more cost-effective alternative to WorkOS as we're building our enterprise data validation portal. Will give it a go and see how we make out - do you have any immediate instructions on integrating with Entra ID? Is it literally just the API endpoint that's needed?
Hey! I'm Ned, the other cofounder at SSOReady. Yes, absolutely. The code you'll write will cover all IDPs. The variation from one IDP to another gets addressed in the configuration settings for each of your customers. For example, I put some documentation together specifically for Entra not too long ago here: https://ssoready.com/docs/idp-configuration/guides-for-commo... Does that get you what you need?
Neat! When i was wearing an Entra (AzureAD) admin hat, i would've really loved to get five-six lines of PowerShell that did the needed steps - rather than having to navigate the web UI labyrinth.
Re: Launch HN: SSOReady (YC W24) – Making SAML SSO painless and open source
#66This looks great! Any plans to add SCIM? SAML is good but one of the main reasons larger customers want SSO in my experience is to automate deprovisioning—they want one-click access removal from all apps when an employee leaves the company. And for that you need SCIM. If you had SAML plus SCIM (or even just a small subset of SCIM) I think it could be a no-brainer. Other services that offer it are closed-source and ab…
Yeah SCIM is coming up. Auto-deprovisioning and stuff related to seat management are the big motivators I've seen. Honestly IETF did a pretty good job with SCIM itself. It's not wacky in the way SAML is at all. In my experience the hardest part about integrating SCIM is setting up all the IDP-specific configuration around it. Like with SAML, it's a situation where Okta, Microsoft, OneLogin all have totally different…
Is OIDC2 also comming? While simpler - a similar "self-help" workflow that helped with all big three SAML, SCIM and OIDC2 - with self-hosting would be marvelous.
Re: Launch HN: SSOReady (YC W24) – Making SAML SSO painless and open source
#67Earlier quoted context omitted.
> Add to that the very often the people you're integrating with have no concept of SAML, its workflows, its payloads, etc., much less the capabilities of their own stack in regards to SAML. So you get to train them (and learn about their system) at the same time. This is true of a great many protocols, unfortunately. I've seen this with IPSec, HL7v2, … CSV . IPSec was perhaps the most … scarring. Always sort of feeli…
HL7v2, the protocol of "we just put all the data in this one random field".
As a base64’d pdf
Re: Launch HN: SSOReady (YC W24) – Making SAML SSO painless and open source
#68I can only wish you good luck. I mean it, best of luck to you all. We wrote our own IdP back in the day. It was a cool project, Single Sign On, Single Sign OUT, User provisioning, just all sorts of stuff. And it worked! It's amazing when it works, it's just like magic. You giggle when it works. We did all sorts of integrations. To random Service Providers, integrating with other IdPs, etc. Some were really cool. Grea…
[deleted]
Re: Launch HN: SSOReady (YC W24) – Making SAML SSO painless and open source
#69Re: Launch HN: SSOReady (YC W24) – Making SAML SSO painless and open source
#70Earlier quoted context omitted.
OKTA does a pretty great job, if you want to spend $2X,XXX per year
I'm referring to the opposite side of the problem. Even if you use Okta, if you want to integrate with company XYZ using SSO, no amount of Okta spend will save you.
Supabase Auth ? https://supabase.com/docs/guides/auth/enterprise-sso/auth-ss...
Seems reasonably easy to use and a good platform to build a SaaS