Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The SSO Wall of Shame

sso.tax

Post reply on HN
Print view View original

21–30 of 44 posts

Re: The SSO Wall of Shame

#21

Post by GekkePrutser »

dijit wrote: post #8
imtringued wrote: post #2

SSO is such a blessing when used inside companies. Who the hell wants to manage acccounts/passwords in every webapp? Absolutely nobody once they get used to SSO.

it's amazing how many companies do not go in for SSO though, because it is often the "extremely expensive" tier. I used to work for Ubisoft, a 20,000+ person company, and SSO was used for almost nothing because it was considered far too costly. conversely: I worked for a Tencent owned studio recently and they used SSO for everything, it was amazing, until the Okta breach (and response, which is worse than the breach…

I'd love it even at home but there seem to be no good FOSS IDP systems. I wish....

At work we use PingID which is not very expensive compared to industry standard ones like Okta. But it's very poor in my opinion. It seems they're always lagging years behind competitors in terms of features.

Re: The SSO Wall of Shame

#22

Post by jrowley »

mooreds wrote: post #18

I thought this comment from Patio11 was topical and interesting: > The right way to think of the "SSO tax" (where companies charge extra for security features) is "You are being offered a dual use product backed by a strong engineering team for far less than it would otherwise cost, with sophisticated enterprises picking up the slack." https://twitter.com/patio11/status/1481293027331440640 Further down the thread: >…

Well browsers essentially started phasing out support for non SSL pages with password fields, which forced sites to get SSL and drive down the cost. Not sure if there is similar united front for SSO.

Re: The SSO Wall of Shame

#23

Post by spacemanmatt »

GekkePrutser wrote: post #21
dijit wrote: post #8

Earlier quoted context omitted.

it's amazing how many companies do not go in for SSO though, because it is often the "extremely expensive" tier. I used to work for Ubisoft, a 20,000+ person company, and SSO was used for almost nothing because it was considered far too costly. conversely: I worked for a Tencent owned studio recently and they used SSO for everything, it was amazing, until the Okta breach (and response, which is worse than the breach…

I'd love it even at home but there seem to be no good FOSS IDP systems. I wish.... At work we use PingID which is not very expensive compared to industry standard ones like Okta. But it's very poor in my opinion. It seems they're always lagging years behind competitors in terms of features.

I'm pretty close to deploying Keycloak at home

Re: The SSO Wall of Shame

#24

Post by easton »

realityking wrote: post #4
go_prodev wrote: post #3

Is there an easy way to get started with SSO on a SAAS app? (Without paying per user on Okta/Auth0) I'm currently using Firebase which supports sign-in with Microsoft, but not sure if that's technically the same as SSO.

Are you looking to offer SSO to users of your SAAS app? Firebase does support SAML: https://medium.com/@tfalvo/single-sign-on-sso-for-your-fireb... Both Microsoft Azure AD and JumpCloud have free plans you can use for testing.

And Microsoft offers a Microsoft 365 Developer Program which gives you 25 accounts with the maximum license (so Azure AD Premium/Conditional Access/etc) as long as you promise not to use them for prod (and they wipe the tenant every 90 days).

https://developer.microsoft.com/en-us/microsoft-365/dev-prog...

Re: The SSO Wall of Shame

#25

Post by dijit »

GekkePrutser wrote: post #21
dijit wrote: post #8

Earlier quoted context omitted.

it's amazing how many companies do not go in for SSO though, because it is often the "extremely expensive" tier. I used to work for Ubisoft, a 20,000+ person company, and SSO was used for almost nothing because it was considered far too costly. conversely: I worked for a Tencent owned studio recently and they used SSO for everything, it was amazing, until the Okta breach (and response, which is worse than the breach…

I'd love it even at home but there seem to be no good FOSS IDP systems. I wish.... At work we use PingID which is not very expensive compared to industry standard ones like Okta. But it's very poor in my opinion. It seems they're always lagging years behind competitors in terms of features.

for an iDP there's always Keycloak and Authentik; both incredibly viable.

The problem is not the hosting of it; it's that nothing will integrate with your iDP, so you can't use your personal keycloak/traefik instance with, say, your github or gitlab profile.

Mozilla Persona was a good idea of handling this[0] but sadly was retired.

[0]: https://en.wikipedia.org/wiki/Mozilla_Persona

Re: The SSO Wall of Shame

#26

Post by altdataseller »

realityking wrote: post #5

I wish there was a hall of fame of vendors who allow SSO for free or a low price. And I don’t mean “Sign-in with Google” - not everyone has company managed Google accounts. Of the top of my head I can think of Mapbox and AWS where it’s free. Atlassian charges $4/month covering all their products (cheap if you use two or more). Any more good examples?

Klaviyo is one example.

Re: The SSO Wall of Shame

#27

Post by m3047 »

The amount of rent seeking by SSOaaS providers goes unremarked and unnoticed.

Pardon the annoying analogy but it's like Java programmers clutching at control which is undermined by not only the language but the JVM itself.

"Java is secure by design.": I get the full stop. You don't want me to say this. But it's not secure in practice.

SaaS vendors all have a vetted list of SSO providers (even if there's only one option in the list). Honestly I'd love to know how SSO vendors market themselves to app vendors. I've never worked with this in a corporate environment.

What I do know is that as a SaaS user, I'd like to be able to provide my own authentication or second factor and that's never in the signup.

Re: The SSO Wall of Shame

#28

Post by rektide »

zrail wrote: post #14

This page underestimates how much it costs to handle SSO as a service provider. Companies that want it are almost always large enough to demand custom contracts, procurement discounts, custom integration work (SSO beyond the big few providers almost always requires custom work), meetings, and security attestations.

Trying to help customers get SSO setup is definitely one of the most painful & elaborate chores we have to suffer at $CURRENTJOB.

We flat up wont do 2/3rds of the asks you listed, but just getting it wired up & going, providing some basic debugging to make it go... we really are apes with hammers trying to pound these systems into going, have little idea what we're doing, & are way undertooled. It feels like super complex tech that requires very specific expertise to wrangle.

That said, I think this site is a great & wonderful & moral cause & I support this wall of shame fully. It just needs to be there, as annoying as it is.

Re: The SSO Wall of Shame

#29

Post by GekkePrutser »

dijit wrote: post #25
GekkePrutser wrote: post #21

Earlier quoted context omitted.

I'd love it even at home but there seem to be no good FOSS IDP systems. I wish.... At work we use PingID which is not very expensive compared to industry standard ones like Okta. But it's very poor in my opinion. It seems they're always lagging years behind competitors in terms of features.

for an iDP there's always Keycloak and Authentik; both incredibly viable. The problem is not the hosting of it; it's that nothing will integrate with your iDP, so you can't use your personal keycloak/traefik instance with, say, your github or gitlab profile. Mozilla Persona was a good idea of handling this[0] but sadly was retired. [0]: https://en.wikipedia.org/wiki/Mozilla_Persona

Thanks, I didn't know that these existed. I will have a look at them.

I don't care about integrating with online services, it's more for my home stuff. I self-host everything of importance anyway. And most external services only integrate with IDPs on their most expensive corporate plans anyway (unless they integrate with Google, Apple or Microsoft consumer accounts which I don't use).

Kinda looking for a personal PKI as well (which can overlap a lot with IDP) but I'll see what these can provide. I looked about 2 years ago and didn't come across either of them.

Re: The SSO Wall of Shame

#30

Post by GekkePrutser »

spacemanmatt wrote: post #23
GekkePrutser wrote: post #21

Earlier quoted context omitted.

I'd love it even at home but there seem to be no good FOSS IDP systems. I wish.... At work we use PingID which is not very expensive compared to industry standard ones like Okta. But it's very poor in my opinion. It seems they're always lagging years behind competitors in terms of features.

I'm pretty close to deploying Keycloak at home

Thanks also. I had a look about 2 years ago during the big Corona lockdown bore and didn't come across it.
Post reply on HN