4 ms·

I would encourage anyone who wants a truly open source IDP platform to consider the Gluu Server[1]. The Gluu Server supports open web standards for authenticati

I would encourage anyone who wants a truly open source IDP platform to consider the Gluu Server[1]. The Gluu Server supports open web standards for authentication and authorization, including SAML 2.0, OAuth 2.0, OpenID Connect, UMA, FIDO U2F, SCIM, and LDAP. It is one of the only--perhaps the only--enterprise-grade identity and access management platform that can be used in production, with an unlimited number of users, without paying a license. [1] http://gluu.org http://gluu.org

Yeroc 10y ago
That said, I imagine anyone running a large deployment will most likely want to purchase a support contract anyways. This is why I don't understand the ForgeRock move (assuming this was intentional -- hard to say at this point): The people that are running larger deployments almost certainly have the budget and need support anyways so I'm doubtful that making the move make the source code less open helps their business in anyway.
- willow9886 10y ago
  I agree... it seems that getting the code into peoples hands would be a positive business driver. But once you raise $50m+ in venture capital, all bets are off.
- webmaven 10y ago
  Adding intrinsic (as opposed to extrinsic) switching costs is usually a bad idea over the long term, but only if your customers (actual or potential) are savvy enough to notice. With that in mind, the approach is much more difficult to pull off with Open Source software. So, investors want (even demand) barriers to entry (for competitors) and/or exit (for customers) to enable extraction of attractive rents. It can work very well over the medium term, although it will typically increase CAC, and lengthen the sales cycle. Still, over the time period that VCs care about, a cash warchest can be used to fuel hockey-stick growth and provide an attractive multiple upon exit, after which growth will often slow or even stall without fresh infusions of cash. The annoying thing about the way this unfolds over and over again, is that it's a cheap trick that isn't really necessary. Equivalent (and far more sustainable) barriers can be erected that don't mandate nuking the developer community around your code.
GuyPaddock 10y ago
Again, my main criticism of Gluu is lack of a transparent security record (I posted a bit more on this lower down in this thread).

Yeroc 10y ago

That said, I imagine anyone running a large deployment will most likely want to purchase a support contract anyways. This is why I don't understand the ForgeRock move (assuming this was intentional -- hard to say at this point): The people that are running larger deployments almost certainly have the budget and need support anyways so I'm doubtful that making the move make the source code less open helps their business in anyway.

willow9886 10y ago
I agree... it seems that getting the code into peoples hands would be a positive business driver. But once you raise $50m+ in venture capital, all bets are off.
webmaven 10y ago
Adding intrinsic (as opposed to extrinsic) switching costs is usually a bad idea over the long term, but only if your customers (actual or potential) are savvy enough to notice. With that in mind, the approach is much more difficult to pull off with Open Source software. So, investors want (even demand) barriers to entry (for competitors) and/or exit (for customers) to enable extraction of attractive rents. It can work very well over the medium term, although it will typically increase CAC, and lengthen the sales cycle. Still, over the time period that VCs care about, a cash warchest can be used to fuel hockey-stick growth and provide an attractive multiple upon exit, after which growth will often slow or even stall without fresh infusions of cash. The annoying thing about the way this unfolds over and over again, is that it's a cheap trick that isn't really necessary. Equivalent (and far more sustainable) barriers can be erected that don't mandate nuking the developer community around your code.

GuyPaddock 10y ago

Again, my main criticism of Gluu is lack of a transparent security record (I posted a bit more on this lower down in this thread).