11–20 of 59 posts
I'm largely in favor of SSO, but it's not without its downsides, going beyond capital costs: SSO can also be implemented in a way that introduces an onerous latency tax when using services.
https://sso.tax
OK, so SSO==OAuth.
What TFA doesn't mention is that we're enabling surveillance capitalism by SSO.
"Who owns the customers" might well be an SMB consideration.
As someone who works on our SSO implementation, the reason for the SSO tax is twofold: - Positioning: it’s seen as an enterprise product so attracts enterprise pricing - Support: it’s genuinely a high touch feature which lots of customers fuck up all the time in the same way and always needs support and engineering help. Documentation for those issues? We have it, it doesn’t stop the support requests coming in. I was…
https://sso.tax
> Single sign-on (SSO) is a mechanism for outsourcing the authentication for your website (or other product) to a third party identity provider, such as Google, Azure AD, Okta, PingFederate, etc. OK, so SSO==OAuth. What TFA doesn't mention is that we're enabling surveillance capitalism by SSO. "Who owns the customers" might well be an SMB consideration.
Granted, it lacks some of the benefits of SAML, such as permissions assignment from a central source. But this is also why those features are so pricey: enterprise organisations derive the most benefit from it, and have a team dedicated to its maintenance.
https://sso.tax
> Single sign-on (SSO) is a mechanism for outsourcing the authentication for your website (or other product) to a third party identity provider, such as Google, Azure AD, Okta, PingFederate, etc. OK, so SSO==OAuth. What TFA doesn't mention is that we're enabling surveillance capitalism by SSO. "Who owns the customers" might well be an SMB consideration.
SSO doesn't have to be Google, Azure, Okta, PingFederate, you can run a stand-alone instance of Keycloak for instance and have OIDC and SAML available to provide SSO functionality.
Earlier quoted context omitted.
> Single sign-on (SSO) is a mechanism for outsourcing the authentication for your website (or other product) to a third party identity provider, such as Google, Azure AD, Okta, PingFederate, etc. OK, so SSO==OAuth. What TFA doesn't mention is that we're enabling surveillance capitalism by SSO. "Who owns the customers" might well be an SMB consideration.
Agreed, they’re conflating things like Google Sign-in with enterprise offerings like SAML. Companies generally give away Google Sign-in for “free” as it’s a great growth vector and gives SMEs a sort-of SAML setup for low cost. It’s also really easy for the vendor to support: you just click the button and you’re in. Granted, it lacks some of the benefits of SAML, such as permissions assignment from a central source. B…
I do work for a number of small businesses and they can't afford the "enterprise cost" for things, so there is a shared password vault instead because there is no centralized management of users.
The small businesses all have some form of SSO available, whether they are using Azure Entra ID or Google Workspaces, they have a central location for users, but the cost is prohibitive for most products to get the upgrade to get access to SAML or OIDC for SSO.
As someone who works on our SSO implementation, the reason for the SSO tax is twofold: - Positioning: it’s seen as an enterprise product so attracts enterprise pricing - Support: it’s genuinely a high touch feature which lots of customers fuck up all the time in the same way and always needs support and engineering help. Documentation for those issues? We have it, it doesn’t stop the support requests coming in. I was…
I feel like a lot of the issues are also due to Azure making it vastly more difficult than necessary to configure OIDC/SAML and get the right information over to the SP.
Earlier quoted context omitted.
Agreed, they’re conflating things like Google Sign-in with enterprise offerings like SAML. Companies generally give away Google Sign-in for “free” as it’s a great growth vector and gives SMEs a sort-of SAML setup for low cost. It’s also really easy for the vendor to support: you just click the button and you’re in. Granted, it lacks some of the benefits of SAML, such as permissions assignment from a central source. B…
They aren't conflating anything. OIDC or SAML should not be "taxed" extra. I do work for a number of small businesses and they can't afford the "enterprise cost" for things, so there is a shared password vault instead because there is no centralized management of users. The small businesses all have some form of SSO available, whether they are using Azure Entra ID or Google Workspaces, they have a central location fo…
Full disclosure: I work at WorkOS ( https://workos.com/ ), we provide SSO (among other things) as a service. I glanced through the report and it comes to the normal conclusion that SSO is hard and expensive to get right. Do SMBs focus on providing value to their customers in the problem space that they are experts at or do they spend months just getting sign-in working? Yeah I get the concern about the "SSO tax" but…
The SMB's already have SSO, they just don't enable it for the SaaS products they buy because of the price.
Earlier quoted context omitted.
I feel like a lot of the issues are also due to Azure making it vastly more difficult than necessary to configure OIDC/SAML and get the right information over to the SP.
I don’t doubt that, however the vendor doesn’t get a choice over the IDP and Azure isn’t even the worst! Last week we had to create a custom Metadata XML file for a customer because their IDP doesn’t accept self-signed certificates. For a certificate we send them. That we can validate on a call with them. And it’s completely undocumented in their IDP’s docs.
Lock support for SSO up behind a paywall, not the actual feature.