4 ms·
I'm surprised not to see my biggest gripe with most services mentioned - half-baked account systems, without proper role or group-based access control. Every s
by dcosson 9y ago
I'm surprised not to see my biggest gripe with most services mentioned - half-baked account systems,
without proper role or group-based access control.
Every startup I've worked at has had some variation of a shared 1Password account, because most Saas
services require a single root account (and I've never heard of a best practice for managing 2FA on any
of these root accounts).
The worst ones of these Saas companies don't even support multiple accounts at all, so anybody on the team that needs to log in always uses this shared account (which is a complete nightmare when anyone leaves the company, as well as far from ideal from a security perspective). The better ones also support separate accounts and roles or groups that you can assign people to for granting permissions. At least then nobody needs the root account for day to day use, so not everyone needs access to it meaning if anyone leaves you can revoke revoke their account without rotating the root password. But even a lot of these still require some sort of "owner" or root account to be hanging around somewhere, which doesn't belong to a single person.
It's very rare in my experience to find a Saas company that uses exclusively role-based access, where "owner" or whatever the top-level permission is is just another role that can be granted to anybody's individual account.
- bognition 9y agoShared accounts are an operational and security nightmare. If everyone shares the same credentials its impossible to cut off a former or disgruntled employee without disrupting everyone else's workflow. Its no wonder that SSO solutions like Okta are taking off
- dandare 9y agoAs an indie SaaS developer, I know I need to add group-based access control and I was looking for an off the shelf solution but I was surprised how complicated this is. I have tried to grok the AWS IAM documentation but I got lost very soon.
- dcosson 9y agoYeah, I've been on that side of it as well and also didn't find anything. Feels like something that could even be formalized into a standard and make things a lot easier and more secure for everyone. IAM in AWS is mostly for internal permissions, to implement principle of least privilege within your account. For user accounts, look at AWS Cognito. I believe they have SAML and Google based login options, or you can implement your own. It's kind of convoluted to get your head around but it is pretty flexible and powerful (like most things AWS).
- lsmith77 9y agohere at Liip, we usually tend to give people full access, so roles are not so relevant, except for my wish to have "billing users" so that we could create a 3rd party like cleanshelf a billing account so that they can extract only the data relevant to their service. Beyond that I really love the usage based billing approach of Slack, where we could just give all our employees access and we get billed on how many actually use the service. Access would be managed via Google Auth or SAML.
- vetinari 9y agoYour point 4 has quite a problem with incentives alignment. You expect the SaaS vendor to spend resources in order to minimize your payment to them - their revenues. I can see why that would be somewhere among the lowest priorities. Also, point 6. I understand where you come from, but you should also understand, that you are using release shared by several/many customers. If everyone had a veto power over rollout, nothing would get rolled out, at all. Therefore, if something gets broken, use your SLA, it is much easier to fix a specific bug, than delay the release.