31–40 of 59 posts
I'm largely in favor of SSO, but it's not without its downsides, going beyond capital costs: SSO can also be implemented in a way that introduces an onerous latency tax when using services.
Earlier quoted context omitted.
To be clear, SMBs should be allowed to use Google Sign-in or Azure’s equivalent for the base pricing. I think this is table stakes for features (and security). SAML? No chance. SMEs don’t need it and my comments above explain why vendors will never offer it.
Google Sign-In is locking people to using Google's infrastructure. If an SMB has already deployed using Azure you don't get access using SSO, instead you have to fall back to username/password? Adding support for OIDC is not that difficult. I prefer OIDC over SAML anyway, but neither is that difficult.
Earlier quoted context omitted.
They aren't conflating anything. OIDC or SAML should not be "taxed" extra. I do work for a number of small businesses and they can't afford the "enterprise cost" for things, so there is a shared password vault instead because there is no centralized management of users. The small businesses all have some form of SSO available, whether they are using Azure Entra ID or Google Workspaces, they have a central location fo…
> OIDC or SAML should not be "taxed" extra. But it costs extra. That cost is passed on to the consumer. The major hurdle is that it's expensive! Take a typical small business SaaS - providing SSO instead of standard passwords can take more time and effort to purchase or develop and to roll out than the actual SaaS software. Okay, lets say you buy SSO: offloading to a service is going to cost a minimum of an extra $20…
If you already use something like "Sign in with {Google,Facebook,Twitter,Apple}" you are already doing part of it.
I have built several products now with OIDC support for authentication (not authorization) and it has never taken more than a day or two to wire it up.
Earlier quoted context omitted.
Forced two factor auth can often solve this kind of thing though.
Why would that help? Where I work we have a central server with some phones connected that act as the 2FA devices for every service where not all employees have their own account, with an internally developed browser extension that grabs the access code from this server upon login.
Earlier quoted context omitted.
They aren't conflating anything. OIDC or SAML should not be "taxed" extra. I do work for a number of small businesses and they can't afford the "enterprise cost" for things, so there is a shared password vault instead because there is no centralized management of users. The small businesses all have some form of SSO available, whether they are using Azure Entra ID or Google Workspaces, they have a central location fo…
> OIDC or SAML should not be "taxed" extra. But it costs extra. That cost is passed on to the consumer. The major hurdle is that it's expensive! Take a typical small business SaaS - providing SSO instead of standard passwords can take more time and effort to purchase or develop and to roll out than the actual SaaS software. Okay, lets say you buy SSO: offloading to a service is going to cost a minimum of an extra $20…
Earlier quoted context omitted.
Forced two factor auth can often solve this kind of thing though.
Why would that help? Where I work we have a central server with some phones connected that act as the 2FA devices for every service where not all employees have their own account, with an internally developed browser extension that grabs the access code from this server upon login.
As someone who works on our SSO implementation, the reason for the SSO tax is twofold: - Positioning: it’s seen as an enterprise product so attracts enterprise pricing - Support: it’s genuinely a high touch feature which lots of customers fuck up all the time in the same way and always needs support and engineering help. Documentation for those issues? We have it, it doesn’t stop the support requests coming in. I was…
Seen? SMBs need to be SOC2 (et al., such as PCI-DSS or HIPAA), and the requirement of controlling all accounts’ permissions at all times is often fulfilled with SSO. How else would you “reset the user’s password after 3 attempts” if the attacker can try the password 3 times on… all of your intranet websites? let alone on Cloud products.
SOC2 is indeed seen as an enterprise feature, but giving access to SMBs strengthens the global security landscape.
Earlier quoted context omitted.
To be clear, SMBs should be allowed to use Google Sign-in or Azure’s equivalent for the base pricing. I think this is table stakes for features (and security). SAML? No chance. SMEs don’t need it and my comments above explain why vendors will never offer it.
Google Sign-In is locking people to using Google's infrastructure. If an SMB has already deployed using Azure you don't get access using SSO, instead you have to fall back to username/password? Adding support for OIDC is not that difficult. I prefer OIDC over SAML anyway, but neither is that difficult.
Since it seems that you know what you are doing (and you've done it before), how about a blog post detailing the steps one would go through when writing some SaaS app for a client who wants SSO?
Bullshit article. The reason SMBs don't deploy SSO is because SaaS and other tooling puts SSO integration behind very high tier paywalls.
I'm talking pricing schemes where sure, you can sign up for a 20 person team on a service because that's the only expected user base in house, but the moment you ask for SSO they demand you license your entire employee headcount.
Among many ridiculous schemes I've dealt with.