IME these usually have shortcomings that the business won't accept, a few I've come across: 1. Only AD or only database accounts when you need a combination of

IME these usually have shortcomings that the business won't accept, a few I've come across: 1. Only AD or only database accounts when you need a combination of both, 2. Only offering role based security when you need something more granular. Side note - a lot of managers expect to be able to jest drop this in a a late requirement, but it usually requires significant work. 3. Not offering documentation on integration. If it includes a permissions system for instance then I also need a way to join against a table of granted permissions for performance. 4. Providing their own UI that's hard to get around. Great for a PoC but often harder to integrate with the rest of the system than writing the login page from scratch. Generally I try to use an existing authentication system but have often had to create a custom security framework.