35 ms·

The reason Okta spent $6.5B on Auth0

217 points by advaitruia 6y ago

suff 6y ago
To be fair it's not nearly as crazy a valuation as $26B for chat.
djrogers 6y ago
I work with a LOT of large enterprises, and I see Okta everywhere. Where I don't see Okta, I see Microsoft and Ping. I've never run across an enterprise using Auth0, so I was surprised to see this statement: >Auth0 is the most prominent alternative that customers consider when evaluating Okta. Is there a feature/vertical where Auth0 and Okta compete that isn't enterprise IDMS? Or was Auth0's market outside of the Fortune 500 space? * edit - OK, it seems clear from the responses that what I see Okta used for (employee/internal identity management) is not what Auth0 was focused on. That makes sense - thanks for all the answers!
- derekp7 6y ago
  The company I work for went with Auth0 for a new SAAS offering, partly because Auth0 kept beating Okta on price (at least for our use case).
  - victor9000 6y ago
    With this acquisition, that won't be the case much longer.
- swagonomixxx 6y ago
  Primarily startups. We've used Auth0 for the last 4 years and we've only ever had one outage.
- mimixco 6y ago
  Startup here who went with Auth0 for our SaaS. It seemed very developer friendly and something we could (and did) on-board ourselves. It gave us a custom, federated identity system that could brand and integrate with our backend without getting into a big enterprise sales cycle. We're a small team.
- ucarion 6y ago
  Okta and Auth0 have mostly been serving the opposite ends of enterprise login, with Okta starting to take on Auth0 (and not so much the other way around). Okta mostly handles being the "enterprise database of users + gateway to your enterprise apps", i.e. it's an identity provider (IdP). ActiveDirectory and PingIdentity are competitors here. Auth0 mostly handles the other end of the line: they help companies be "a thing you can log into using an IdP", i.e. they help companies be a service provider (SP). Custom SAML/OIDC implementations are the biggest competitors here. Okta has increasingly been competing with Auth0 in the space of SaaS SP solutions. So it's in the latter half -- service providers -- where the two compete. You may have been looking in the wrong place. Plus, not all companies are service providers, and many companies that are service providers roll their own implementation of the relevant protocols.
- mooreds 6y ago
  I would say that Okta was primarily IAM (identity and access management for your employees) and Auth0 was primarily CIAM (customer identity and access management). So I think they both were aiming at the same customers, just for different use cases.
- milesdyson_phd 6y ago
  We were/are (Fortune 500) in the process of migrating from Ping to Auth0... Glad I’m not on the group that’s been working on that for the past 1-2 years
  - exikyut 6y ago
    Interesting sentiment. What were the pain points? What was better about Ping? Your comment is an interesting contrast against https://news.ycombinator.com/item?id=26359752 https://news.ycombinator.com/item?id=26359752
- 0xbadcafebee 6y ago
  A lot of enterprises pick the cheapest option. Especially if it's just one business unit making the choice.
nailer 6y ago
Does the ~S~E~C~ (edit: FTC) have to approve? If so, have they? https://en.wikipedia.org/wiki/Hart%E2%80%93Scott%E2%80%93Rodino_Antitrust_Improvements_Act https://en.wikipedia.org/wiki/Hart%E2%80%93Scott%E2%80%93Rod... ------------------------- The general rule is that a filing is required if three tests are met: * (1) the transaction affects U.S. commerce; (2) either (a) one of the parties has annual sales or total assets of $151.7 million[3] or more (as of 2014: in 2012 this threshold amount began increasing periodically under the law), and the other party has sales or assets of $15.2 million[3] or more (as of 2014: this amount adjusts periodically) (where an acquired person is not engaged in manufacturing, only its total assets, not its sales, are counted, unless its sales are over $151.7 million[3]); or (b) the amount of stock the acquirer has is valued at $272.8 million or more (as of 2012: amount adjusts periodically) at any time; and (3) the value of the securities or assets of the other party held by the acquirer after the transaction is $68.2 million or more (as of 2012: amount adjusts periodically).[4] The 2018 rules raise this amount to US$84.4 million [5] ------------------------- * IANAL, but I worked somewhere that was charged with violating the act and it's any of the three, not all of them.
- staysaasy 6y ago
  They will need to for a transaction of this size, and the approval process is most likely ongoing (and will continue for the next few months).
- lvzwilson 6y ago
  FYI, it is not the SEC that approves mergers with respect to antitrust concerns, but rather the FTC or DOJ. See https://www.ftc.gov/news-events/media-resources/mergers-and-competition/merger-review https://www.ftc.gov/news-events/media-resources/mergers-and-...
- advisedwang 6y ago
  I'd like to see the FTC get involved. Seems like this is going to reduce competition.
  - toomuchtodo 6y ago
arawde 6y ago
> Okta will issue shares to Auth0 shareholders at share price of $276.21, close to 20% less than the current share price (at the time of writing). The screenshot immediately under this statement shows an Okta share price of $226. Am I misunderstanding something?
- coreyja 6y ago
  $276.21 - 20% = $220.968 So not far off from $226 $226 / $276.21 = 81.8% So its 18.2% to be exact Edit: Realized the quote/article says 20% LOWER. Which is backwards, and is likely what my parent comment is pointing out
- deleted 6y ago
  [deleted]
- kweinber 6y ago
  The deal had to be done at a certain time, which froze the value of the shares at the price. The shares were probably reserved for this purpose at that time.
- deleted 6y ago
  [deleted]
- jiveturkey 6y ago
  The screenshot did not properly show the price "at the time of writing". sloppy, that's all.
  - advaitruia 6y ago
    The chart didnt cover after hour pricing unfortunately (which is what was being referenced). Note taken though, will keep it in mind!
willeh 6y ago
Most importantly Auth0 was beating Okta on execution. Auth0 was leaner and would soon get to feature parity for both use cases. Without this deal they would slowly have lost ground to Auth0.
- distrill 6y ago
  This seems to be so transparently the case, how is this behavior not considered anti competitive?
  - WJW 6y ago
    Almost any behavior by a company to outdo its competitors can be described as anti competitive, but not all forms are illegal. Straight from the wikipedia page: > Anti-competitive practices are commonly only deemed illegal when the practice results in a substantial dampening in competition, hence why for a firm to be punished for any form of anti-competitive behaviour they generally need to be a monopoly or a dominant firm in a duopoly or oligopoly who has significant influence over the market. Since there are many auth providers (ie https://en.wikipedia.org/wiki/List_of_OAuth_providers https://en.wikipedia.org/wiki/List_of_OAuth_providers) in the market, the takeover of auth0 by okta is not a problem for "the market". It is therefore up to the shareholders of auth0 to sell their shares or not and clearly they chose to cash out instead of gambling that they could continue to out-execute okta and their other competitors.
    - nicoburns 6y ago
      I imagine the parent is questioning why the definition for "a substantial dampening in competition" is so strict. To me it seems that they are claiming that this clearly constitutes a substantial dampening in competition, and are thus questioning why it is not illegal.
      - ethbr0 6y ago
        By that metric, wouldn't profitless growth-over-capitalizing also dampen competition? It's a tortured argument to say that SoftBank's investments are creating more competition or innovation.
disgrunt 6y ago
Anyone want to start a competing SSO service?
- toomuchtodo 6y ago
  WorkOS, FusionAuth, Keycloak, the ecosystem is flush. Vote with your dollars and your implementation.
  - dv_dt 6y ago
    What are the interesting contrasts & differentiators in the ecosystem in your opinion?
    - mooreds 6y ago
      I work for FusionAuth and we have some comparisons on our website, but I haven't built an application with each of these. I'd say that dimensions that matter vary so widely for each person and use case, it'd be hard to do a great comparison. Dimensions that matter: * open source or not * standalone application or library/framework you integrate * self hosted or SaaS * authentication, authorization, user management or all three? * standards implementation * integrations with other auth tech (LDAP) * which OAuth grants they support * documentation and developer experience And that doesn't get into specific features that you might need. An example: if you want to modify a user object in the middle of a login flow, Auth0 has rules, we have Lambdas, Keycloak has plugins. How are you going to know what features you need without building out at least a sample app? Oh, and pricing! Lots of the smaller operations (us included) have transparent pricing, but Okta/Auth0 don't. I wrote out a list of 13 different use cases for FusionAuth ( https://github.com/fusionauth/fusionauth-issues/issues/1002 https://github.com/fusionauth/fusionauth-issues/issues/1002 ) and I am still discovering new ways this coiuld be used. I'm sure that is the case with all these competitors. It's the old elephant story: https://www.peacecorps.gov/educators/resources/story-blind-men-and-elephant/ https://www.peacecorps.gov/educators/resources/story-blind-m...
  - advaitruia 6y ago
    + supertokens.io
naringas 6y ago
Looks like this is only good for people whose chief activity is "owning stuff". Everybody else (specifically people who actually execute actions, build stuff) loses.
wenbin 6y ago
Waiting for "I can build this over a weekend" comment on Hacker News :)
- manishsharan 6y ago
  since you asked for it : https://developers.redhat.com/blog/2017/01/05/spring-boot-and-oauth2-with-keycloak/ https://developers.redhat.com/blog/2017/01/05/spring-boot-an...
  - moooo99 6y ago
    Honestly, properly configuring, maintaining and scaling Keycloak is an absolute pain in my experience. Keyclaok does not come close to the ease of use of Okta and Auth0 imho
    - turtlebits 6y ago
      Can you please elaborate on the issues you are seeing? I just got started, but so far my experience setting Keycloak up has been the best I've experienced for an open source project in a while. I was up and running within a few hours- Got a simple JS app working, and was able to secure all my existing services by integrating with my ingress controller.
      - thinkharderdev 6y ago
        Recently moved away from Keycloak (which I think overall is a great piece of software but was just a PITA for our use case) and my observations: * Zero-downtime deployments don't really work. They kinda-sorta do but it was too clunky for us to do it effectively during periods when we had significant traffic. Not generally an issue if you are just using out-of-the-box components but if you are deploying custom components (Storage providers, authenticators, etc) then it doesn't work that well. * It uses an in-memory distributed cache for authentication sessions so if your instance goes down (or you need to shut it down for a major version upgrade) then everyone is logged out. It also seems to have a lot of trouble scaling out to more than ~8 nodes. At the minimum you have to do a lot of tuning of infinispan parameters to get it to work at scale. * Configuration is kind of a pain because it has to be done through the UI. There is a REST API but it is really hard to work with if you want to do something like deploy a change to an authentication flow configuration. So forget about managing your configs in source control (and prepare for the inevitable issues that happen when configs aren't properly updated with deployment because someone fat-fingers something in the configuration UI). * There is a LOT of stuff that is hard-coded in the core Keycloak engine that makes customization impossible short of modifying the actual Keycloak source itself and running your own build (not recommended!). * One small thing that nonetheless drove me crazy is the Keycloak injects a JS snippet into rendered templates to munge the browser history and has no way for you to insert a nonce in the script tag, so setting up CSP headers was way harder than it should have been. All that said, it was more that Keycloak was not the right tool for our use case (an always-on user-facing identity provider) but if you just need a basic login/registration screen and are fine using Keycloak's built-in components (with maybe just some thumbing) then it works great.
cphoover 6y ago
When people say oh it has a $30 Billion addressable market... how do they come up with these numbers? Startup CEO types love to throw around these numbers but some time they seem wildly optimistic, and their methodology is rarely explained.
- malyk 6y ago
  Could be as simple as "number of companies that need auth x number of employees of that company x average cost per seat for Okta/Auth0". Now, figuring out some of those numbers is harder. Okta simplest pricing is $2 per person per month, but to really us it you are looking at paying more like $15 a month. So, per user it's $180 a year. 30 billion / 180 = 166 million users. If average company size is 500, that's 330k companies, which is a lot. Anyway, those are just very quick back of the napkin numbers. I would guess they've done a little more work to come up with the number. (pls forgive any math errors/rounding!)
  - pc86 6y ago
    Yeah these figures really are less to differentiate between the $33 billion and $34 billion markets, and more to differentiate between the $33 billion and $33 million markets. Just a way to get a rough idea of approximate size, as compared to other rough ideas of approximate size.
postit 6y ago
They OH auth0 was using mongo to store customers’ data and wanted to fix that.
tofuahdude 6y ago
Having integrated both... Okta is an awful product and Auth0 is an excellent product. Night and day difference in quality.
colinclerk 6y ago
My take on this is a little different. (Disc: I'm a cofounder of Clerk which is also in the space) I think Okta will try to build "Okta for Customer ID" When people think of Okta, they think of it as a tool to help employees securely access third-party SaaS vendors. That same problem exists for Customer Identity, but it looks a little different. Instead of setting up SSO for SaaS, developers are writing code to pass their customer data into tools like Stripe, Intercom, Salesforce, Segment, Mailchimp, etc, etc. This is redundant work that a centralized Customer identity provider has the potential to alleviate. I don't really think Auth0 is well-positioned to pull this off, and that's part of why we started Clerk. But considering Okta has that playbook in it's DNA, I wouldn't be surprised if that's what they're attempting.
- ignoramous 6y ago
  > But considering Okta has that playbook in it's DNA, I wouldn't be surprised if that's what they're attempting. I'm sorry; Okta has which playbook in its DNA?
  - colinclerk 6y ago
    Third party integrations
- ucarion 6y ago
  Why aren't all the existing products in ETL-for-marketers space already the answer to the question you pose? Most companies have a users table, and there are a ton of products that can, without code, ETL a users table into all sorts of tools. There's no redundant work -- in fact, for developers there may not be any work to do at all?
  - colinclerk 6y ago
    Because they don't know confidently which user is logged in. A lot of the marketing tools rely on insecure signals, like a userID passed directly from javascript. If you want to trigger actions rather than observe them, you need a secure way of authenticating those actions. That's why Clerk does session management :)
grinich 6y ago
If anyone's looking for an Auth0 alternative, I recommend checking out WorkOS. It's like Stripe for enterprise features, including SSO/SAML, Directory/SCIM, and more. https://workos.com/docs https://workos.com/docs (I'm the founder. Hope it's still ok to shamelessly plug your startup on HN. :) )
- pm90 6y ago
  Please plug away. I was so pleasantly surprised to view documentation that did not suck, and was a pleasure to read. After going through the Sisyphean ordeal of trying to read and understand okta's api docs for so long, this was a breath of fresh air. While my current org is locked on to okta, will definitely consider/recommend this for future efforts.
dang 6y ago
Recent and related: Okta to Acquire Auth0 for $6.5B - https://news.ycombinator.com/item?id=26334516 https://news.ycombinator.com/item?id=26334516 - March 2021 (309 comments)
polote 6y ago
> Okta is built as a top down sales organisation whereas Auth0 is built with a developer first bottoms up acquisition strategy. This allows Okta to get the best of both worlds. Good luck with that. The CEO of Okta will have to be very very very smart to keep this atmosphere around Auth0. So easier to say that's it's not going to happen. When you are an enterprise company you don't buy a customer centric company to become them, you do the opposite. You make them become like you
- deleted 6y ago
  [deleted]
pdx6 6y ago
Not long ago I worked at Okta, and I know their engineering process pretty well. If I were to speculate on the purchase on Auth0, it would be to get more engineers improving the Okta platform. There are some really hard scaling problems and some really hard security problems, and absorbing Auth0's talent is a way to acquire specialty talent in a narrow space. Finding the right engineer who can program securely, scale, and make the developer empathy painless is a key challenge. This is what Okta did with Stormpath before the IPO. (Disclosure: long OKTA)
robertlagrant 6y ago
> it can also refactor Auth0’s (and it’s own) pricing to increase revenue even further. Yeah, about that. Auth0 is already struggling to compete with Firebase Auth, AWS Cognito, and even Azure AD B2C (at least on price, for that last one). Increasing the price further is a bad idea. Also, ory.sh is coming. If I were Salesforce, I'd be funding that to just commoditise auth.
cwkoss 6y ago
> Auth0 is the most prominent alternative that customers consider when evaluating Okta. The acquisition of Auth0 eliminates that threat and grants Okta pricing power as a result. "Grants pricing power" is such a euphemistic phrase for "solidifying a monopoly will let them price gouge"
- xapata 6y ago
  Or "monopolistic price gouging" is a dysphemism for having a stable business in a tough market. They need to make enough profit to avoid capital outflow.
  - tsimionescu 6y ago
    Buying a competitor is always a dubious move towards monopoly. If the ideal free market is supposed to have all sorts of advantages, then anything which reduces the ideal-ness of the actual market must be viewed as negative.
    - xapata 6y ago
      No, that logic doesn't hold. Further, I think you're conflating two meanings of the word ideal. In the context of an ideal free market, the meaning is closer to hypothetical and is pretty far away from the sense of ethical or practical goodness. Also, it's not clear that an "ideal" free market is a stable equilibrium. And lastly, if an ideal free market permits the existence of corporations (I'm not sure that it does) then it must allow one to purchase another.
    - xapata 6y ago
      Seems like I should have better explained why the logic doesn't hold. Even if we grant that an ideal market is a good thing (which is debatable), it's still not certain that all motion towards an ideal market is positive good. The space through which one moves may not be monotonically increasing in the goodness direction.
  - hinkley 6y ago
    Except now they have to make an extra half billion a year just to justify spending the money instead of putting it into a more liquid investment. Or themselves.
deleted 6y ago
[deleted]
advaitruia 6y ago
Author of the article here. Feel free to AMA about the acquisition (or about SuperTokens)
pwlb 6y ago
Self-Sovereign Identity might replace major parts of the federated identity market within 5 years i expect. even Okta CEO admitted that self-sovereign identity will be the future. the major problem is that the decentralized nature of SSI, will remove the most part and profit of 3rd party tools, as it is easier and cheaper to have direct relations between services and users
Naac 6y ago
What are some open source self hosted alternatives to Okta and Auth0?
- advaitruia 6y ago
  Keycloak, Ory Hydra, and supertokens.io
egberts 6y ago
Okta’s core strength is in her predominately salespeople; programmers, not so much.
nikolay 6y ago
Auth0 was actually no alternative given its pricing. I actually saw a lot of people moving to Firebase from Auth0.
deleted 6y ago
[deleted]
revskill 6y ago
Auth is easy, right ? The pain point to me is authorization. Doing authorization correctly is really hard. But most of frameworks i see (open source or closed source) failed at that job.
honksillet 6y ago
Did any employees get screwed when it came to stock options?
spondyl 6y ago
Company realises that they have become kind of slow and that their culture is not conductive to moving fast, innovation and making more money "We could just buy a culture that is" and then either they keep it alive or the original culture destroyed the acquired one and the process starts again? Isn't that like half of acquisitions or maybe I'm being too simplistic, I dunno
TechBro8615 6y ago
> Auth0 is built with a developer first bottoms up acquisition strategy I really wish people would stop saying “bottoms up.” This is what you say when you’re clinking glasses together. The phrase people are looking for here is “bottom up,” as in “up from the bottom of the organization.” So unless they mean they’re starting from a developer’s ass, or preparing to ram their product up a bunch of developers’ exposed bottoms, it would be nice if people learned this expression.

217 points by advaitruia 6y ago

suff 6y ago

To be fair it's not nearly as crazy a valuation as $26B for chat.

I work with a LOT of large enterprises, and I see Okta everywhere. Where I don't see Okta, I see Microsoft and Ping. I've never run across an enterprise using Auth0, so I was surprised to see this statement: >Auth0 is the most prominent alternative that customers consider when evaluating Okta. Is there a feature/vertical where Auth0 and Okta compete that isn't enterprise IDMS? Or was Auth0's market outside of the Fortune 500 space? * edit - OK, it seems clear from the responses that what I see Okta used for (employee/internal identity management) is not what Auth0 was focused on. That makes sense - thanks for all the answers!

derekp7 6y ago
The company I work for went with Auth0 for a new SAAS offering, partly because Auth0 kept beating Okta on price (at least for our use case).
- victor9000 6y ago
  With this acquisition, that won't be the case much longer.
swagonomixxx 6y ago
Primarily startups. We've used Auth0 for the last 4 years and we've only ever had one outage.
mimixco 6y ago
Startup here who went with Auth0 for our SaaS. It seemed very developer friendly and something we could (and did) on-board ourselves. It gave us a custom, federated identity system that could brand and integrate with our backend without getting into a big enterprise sales cycle. We're a small team.
ucarion 6y ago
Okta and Auth0 have mostly been serving the opposite ends of enterprise login, with Okta starting to take on Auth0 (and not so much the other way around). Okta mostly handles being the "enterprise database of users + gateway to your enterprise apps", i.e. it's an identity provider (IdP). ActiveDirectory and PingIdentity are competitors here. Auth0 mostly handles the other end of the line: they help companies be "a thing you can log into using an IdP", i.e. they help companies be a service provider (SP). Custom SAML/OIDC implementations are the biggest competitors here. Okta has increasingly been competing with Auth0 in the space of SaaS SP solutions. So it's in the latter half -- service providers -- where the two compete. You may have been looking in the wrong place. Plus, not all companies are service providers, and many companies that are service providers roll their own implementation of the relevant protocols.
mooreds 6y ago
I would say that Okta was primarily IAM (identity and access management for your employees) and Auth0 was primarily CIAM (customer identity and access management). So I think they both were aiming at the same customers, just for different use cases.
milesdyson_phd 6y ago
We were/are (Fortune 500) in the process of migrating from Ping to Auth0... Glad I’m not on the group that’s been working on that for the past 1-2 years
- exikyut 6y ago
  Interesting sentiment. What were the pain points? What was better about Ping? Your comment is an interesting contrast against https://news.ycombinator.com/item?id=26359752 https://news.ycombinator.com/item?id=26359752
0xbadcafebee 6y ago
A lot of enterprises pick the cheapest option. Especially if it's just one business unit making the choice.

nailer 6y ago

Does the ~S~E~C~ (edit: FTC) have to approve? If so, have they? https://en.wikipedia.org/wiki/Hart%E2%80%93Scott%E2%80%93Rodino_Antitrust_Improvements_Act https://en.wikipedia.org/wiki/Hart%E2%80%93Scott%E2%80%93Rod... ------------------------- The general rule is that a filing is required if three tests are met: * (1) the transaction affects U.S. commerce; (2) either (a) one of the parties has annual sales or total assets of $151.7 million[3] or more (as of 2014: in 2012 this threshold amount began increasing periodically under the law), and the other party has sales or assets of $15.2 million[3] or more (as of 2014: this amount adjusts periodically) (where an acquired person is not engaged in manufacturing, only its total assets, not its sales, are counted, unless its sales are over $151.7 million[3]); or (b) the amount of stock the acquirer has is valued at $272.8 million or more (as of 2012: amount adjusts periodically) at any time; and (3) the value of the securities or assets of the other party held by the acquirer after the transaction is $68.2 million or more (as of 2012: amount adjusts periodically).[4] The 2018 rules raise this amount to US$84.4 million [5] ------------------------- * IANAL, but I worked somewhere that was charged with violating the act and it's any of the three, not all of them.

staysaasy 6y ago
They will need to for a transaction of this size, and the approval process is most likely ongoing (and will continue for the next few months).
lvzwilson 6y ago
FYI, it is not the SEC that approves mergers with respect to antitrust concerns, but rather the FTC or DOJ. See https://www.ftc.gov/news-events/media-resources/mergers-and-competition/merger-review https://www.ftc.gov/news-events/media-resources/mergers-and-...
advisedwang 6y ago
I'd like to see the FTC get involved. Seems like this is going to reduce competition.
- toomuchtodo 6y ago

arawde 6y ago

> Okta will issue shares to Auth0 shareholders at share price of $276.21, close to 20% less than the current share price (at the time of writing). The screenshot immediately under this statement shows an Okta share price of $226. Am I misunderstanding something?

coreyja 6y ago
$276.21 - 20% = $220.968 So not far off from $226 $226 / $276.21 = 81.8% So its 18.2% to be exact Edit: Realized the quote/article says 20% LOWER. Which is backwards, and is likely what my parent comment is pointing out
deleted 6y ago
[deleted]
kweinber 6y ago
The deal had to be done at a certain time, which froze the value of the shares at the price. The shares were probably reserved for this purpose at that time.
deleted 6y ago
[deleted]
jiveturkey 6y ago
The screenshot did not properly show the price "at the time of writing". sloppy, that's all.
- advaitruia 6y ago
  The chart didnt cover after hour pricing unfortunately (which is what was being referenced). Note taken though, will keep it in mind!

willeh 6y ago

Most importantly Auth0 was beating Okta on execution. Auth0 was leaner and would soon get to feature parity for both use cases. Without this deal they would slowly have lost ground to Auth0.

distrill 6y ago
This seems to be so transparently the case, how is this behavior not considered anti competitive?
- WJW 6y ago
  Almost any behavior by a company to outdo its competitors can be described as anti competitive, but not all forms are illegal. Straight from the wikipedia page: > Anti-competitive practices are commonly only deemed illegal when the practice results in a substantial dampening in competition, hence why for a firm to be punished for any form of anti-competitive behaviour they generally need to be a monopoly or a dominant firm in a duopoly or oligopoly who has significant influence over the market. Since there are many auth providers (ie https://en.wikipedia.org/wiki/List_of_OAuth_providers https://en.wikipedia.org/wiki/List_of_OAuth_providers) in the market, the takeover of auth0 by okta is not a problem for "the market". It is therefore up to the shareholders of auth0 to sell their shares or not and clearly they chose to cash out instead of gambling that they could continue to out-execute okta and their other competitors.
  - nicoburns 6y ago
    I imagine the parent is questioning why the definition for "a substantial dampening in competition" is so strict. To me it seems that they are claiming that this clearly constitutes a substantial dampening in competition, and are thus questioning why it is not illegal.
    - ethbr0 6y ago
      By that metric, wouldn't profitless growth-over-capitalizing also dampen competition? It's a tortured argument to say that SoftBank's investments are creating more competition or innovation.

disgrunt 6y ago

Anyone want to start a competing SSO service?

toomuchtodo 6y ago
WorkOS, FusionAuth, Keycloak, the ecosystem is flush. Vote with your dollars and your implementation.
- dv_dt 6y ago
  What are the interesting contrasts & differentiators in the ecosystem in your opinion?
  - mooreds 6y ago
    I work for FusionAuth and we have some comparisons on our website, but I haven't built an application with each of these. I'd say that dimensions that matter vary so widely for each person and use case, it'd be hard to do a great comparison. Dimensions that matter: * open source or not * standalone application or library/framework you integrate * self hosted or SaaS * authentication, authorization, user management or all three? * standards implementation * integrations with other auth tech (LDAP) * which OAuth grants they support * documentation and developer experience And that doesn't get into specific features that you might need. An example: if you want to modify a user object in the middle of a login flow, Auth0 has rules, we have Lambdas, Keycloak has plugins. How are you going to know what features you need without building out at least a sample app? Oh, and pricing! Lots of the smaller operations (us included) have transparent pricing, but Okta/Auth0 don't. I wrote out a list of 13 different use cases for FusionAuth ( https://github.com/fusionauth/fusionauth-issues/issues/1002 https://github.com/fusionauth/fusionauth-issues/issues/1002 ) and I am still discovering new ways this coiuld be used. I'm sure that is the case with all these competitors. It's the old elephant story: https://www.peacecorps.gov/educators/resources/story-blind-men-and-elephant/ https://www.peacecorps.gov/educators/resources/story-blind-m...
- advaitruia 6y ago
  + supertokens.io

naringas 6y ago

Looks like this is only good for people whose chief activity is "owning stuff". Everybody else (specifically people who actually execute actions, build stuff) loses.

wenbin 6y ago

Waiting for "I can build this over a weekend" comment on Hacker News :)

manishsharan 6y ago
since you asked for it : https://developers.redhat.com/blog/2017/01/05/spring-boot-and-oauth2-with-keycloak/ https://developers.redhat.com/blog/2017/01/05/spring-boot-an...
- moooo99 6y ago
  Honestly, properly configuring, maintaining and scaling Keycloak is an absolute pain in my experience. Keyclaok does not come close to the ease of use of Okta and Auth0 imho
  - turtlebits 6y ago
    Can you please elaborate on the issues you are seeing? I just got started, but so far my experience setting Keycloak up has been the best I've experienced for an open source project in a while. I was up and running within a few hours- Got a simple JS app working, and was able to secure all my existing services by integrating with my ingress controller.
    - thinkharderdev 6y ago
      Recently moved away from Keycloak (which I think overall is a great piece of software but was just a PITA for our use case) and my observations: * Zero-downtime deployments don't really work. They kinda-sorta do but it was too clunky for us to do it effectively during periods when we had significant traffic. Not generally an issue if you are just using out-of-the-box components but if you are deploying custom components (Storage providers, authenticators, etc) then it doesn't work that well. * It uses an in-memory distributed cache for authentication sessions so if your instance goes down (or you need to shut it down for a major version upgrade) then everyone is logged out. It also seems to have a lot of trouble scaling out to more than ~8 nodes. At the minimum you have to do a lot of tuning of infinispan parameters to get it to work at scale. * Configuration is kind of a pain because it has to be done through the UI. There is a REST API but it is really hard to work with if you want to do something like deploy a change to an authentication flow configuration. So forget about managing your configs in source control (and prepare for the inevitable issues that happen when configs aren't properly updated with deployment because someone fat-fingers something in the configuration UI). * There is a LOT of stuff that is hard-coded in the core Keycloak engine that makes customization impossible short of modifying the actual Keycloak source itself and running your own build (not recommended!). * One small thing that nonetheless drove me crazy is the Keycloak injects a JS snippet into rendered templates to munge the browser history and has no way for you to insert a nonce in the script tag, so setting up CSP headers was way harder than it should have been. All that said, it was more that Keycloak was not the right tool for our use case (an always-on user-facing identity provider) but if you just need a basic login/registration screen and are fine using Keycloak's built-in components (with maybe just some thumbing) then it works great.

cphoover 6y ago

When people say oh it has a $30 Billion addressable market... how do they come up with these numbers? Startup CEO types love to throw around these numbers but some time they seem wildly optimistic, and their methodology is rarely explained.

malyk 6y ago
Could be as simple as "number of companies that need auth x number of employees of that company x average cost per seat for Okta/Auth0". Now, figuring out some of those numbers is harder. Okta simplest pricing is $2 per person per month, but to really us it you are looking at paying more like $15 a month. So, per user it's $180 a year. 30 billion / 180 = 166 million users. If average company size is 500, that's 330k companies, which is a lot. Anyway, those are just very quick back of the napkin numbers. I would guess they've done a little more work to come up with the number. (pls forgive any math errors/rounding!)
- pc86 6y ago
  Yeah these figures really are less to differentiate between the $33 billion and $34 billion markets, and more to differentiate between the $33 billion and $33 million markets. Just a way to get a rough idea of approximate size, as compared to other rough ideas of approximate size.

postit 6y ago

They OH auth0 was using mongo to store customers’ data and wanted to fix that.

tofuahdude 6y ago

Having integrated both... Okta is an awful product and Auth0 is an excellent product. Night and day difference in quality.

colinclerk 6y ago

My take on this is a little different. (Disc: I'm a cofounder of Clerk which is also in the space) I think Okta will try to build "Okta for Customer ID" When people think of Okta, they think of it as a tool to help employees securely access third-party SaaS vendors. That same problem exists for Customer Identity, but it looks a little different. Instead of setting up SSO for SaaS, developers are writing code to pass their customer data into tools like Stripe, Intercom, Salesforce, Segment, Mailchimp, etc, etc. This is redundant work that a centralized Customer identity provider has the potential to alleviate. I don't really think Auth0 is well-positioned to pull this off, and that's part of why we started Clerk. But considering Okta has that playbook in it's DNA, I wouldn't be surprised if that's what they're attempting.

ignoramous 6y ago
> But considering Okta has that playbook in it's DNA, I wouldn't be surprised if that's what they're attempting. I'm sorry; Okta has which playbook in its DNA?
- colinclerk 6y ago
  Third party integrations
ucarion 6y ago
Why aren't all the existing products in ETL-for-marketers space already the answer to the question you pose? Most companies have a users table, and there are a ton of products that can, without code, ETL a users table into all sorts of tools. There's no redundant work -- in fact, for developers there may not be any work to do at all?
- colinclerk 6y ago
  Because they don't know confidently which user is logged in. A lot of the marketing tools rely on insecure signals, like a userID passed directly from javascript. If you want to trigger actions rather than observe them, you need a secure way of authenticating those actions. That's why Clerk does session management :)

grinich 6y ago

If anyone's looking for an Auth0 alternative, I recommend checking out WorkOS. It's like Stripe for enterprise features, including SSO/SAML, Directory/SCIM, and more. https://workos.com/docs https://workos.com/docs (I'm the founder. Hope it's still ok to shamelessly plug your startup on HN. :) )

pm90 6y ago
Please plug away. I was so pleasantly surprised to view documentation that did not suck, and was a pleasure to read. After going through the Sisyphean ordeal of trying to read and understand okta's api docs for so long, this was a breath of fresh air. While my current org is locked on to okta, will definitely consider/recommend this for future efforts.

dang 6y ago

Recent and related: Okta to Acquire Auth0 for $6.5B - https://news.ycombinator.com/item?id=26334516 https://news.ycombinator.com/item?id=26334516 - March 2021 (309 comments)

polote 6y ago

> Okta is built as a top down sales organisation whereas Auth0 is built with a developer first bottoms up acquisition strategy. This allows Okta to get the best of both worlds. Good luck with that. The CEO of Okta will have to be very very very smart to keep this atmosphere around Auth0. So easier to say that's it's not going to happen. When you are an enterprise company you don't buy a customer centric company to become them, you do the opposite. You make them become like you

deleted 6y ago
[deleted]

pdx6 6y ago

Not long ago I worked at Okta, and I know their engineering process pretty well. If I were to speculate on the purchase on Auth0, it would be to get more engineers improving the Okta platform. There are some really hard scaling problems and some really hard security problems, and absorbing Auth0's talent is a way to acquire specialty talent in a narrow space. Finding the right engineer who can program securely, scale, and make the developer empathy painless is a key challenge. This is what Okta did with Stormpath before the IPO. (Disclosure: long OKTA)

robertlagrant 6y ago

> it can also refactor Auth0’s (and it’s own) pricing to increase revenue even further. Yeah, about that. Auth0 is already struggling to compete with Firebase Auth, AWS Cognito, and even Azure AD B2C (at least on price, for that last one). Increasing the price further is a bad idea. Also, ory.sh is coming. If I were Salesforce, I'd be funding that to just commoditise auth.

cwkoss 6y ago

> Auth0 is the most prominent alternative that customers consider when evaluating Okta. The acquisition of Auth0 eliminates that threat and grants Okta pricing power as a result. "Grants pricing power" is such a euphemistic phrase for "solidifying a monopoly will let them price gouge"

xapata 6y ago
Or "monopolistic price gouging" is a dysphemism for having a stable business in a tough market. They need to make enough profit to avoid capital outflow.
- tsimionescu 6y ago
  Buying a competitor is always a dubious move towards monopoly. If the ideal free market is supposed to have all sorts of advantages, then anything which reduces the ideal-ness of the actual market must be viewed as negative.
  - xapata 6y ago
    No, that logic doesn't hold. Further, I think you're conflating two meanings of the word ideal. In the context of an ideal free market, the meaning is closer to hypothetical and is pretty far away from the sense of ethical or practical goodness. Also, it's not clear that an "ideal" free market is a stable equilibrium. And lastly, if an ideal free market permits the existence of corporations (I'm not sure that it does) then it must allow one to purchase another.
  - xapata 6y ago
    Seems like I should have better explained why the logic doesn't hold. Even if we grant that an ideal market is a good thing (which is debatable), it's still not certain that all motion towards an ideal market is positive good. The space through which one moves may not be monotonically increasing in the goodness direction.
- hinkley 6y ago
  Except now they have to make an extra half billion a year just to justify spending the money instead of putting it into a more liquid investment. Or themselves.

deleted 6y ago

[deleted]

advaitruia 6y ago

Author of the article here. Feel free to AMA about the acquisition (or about SuperTokens)

pwlb 6y ago

Self-Sovereign Identity might replace major parts of the federated identity market within 5 years i expect. even Okta CEO admitted that self-sovereign identity will be the future. the major problem is that the decentralized nature of SSI, will remove the most part and profit of 3rd party tools, as it is easier and cheaper to have direct relations between services and users

Naac 6y ago

What are some open source self hosted alternatives to Okta and Auth0?

advaitruia 6y ago
Keycloak, Ory Hydra, and supertokens.io

egberts 6y ago

Okta’s core strength is in her predominately salespeople; programmers, not so much.

nikolay 6y ago

Auth0 was actually no alternative given its pricing. I actually saw a lot of people moving to Firebase from Auth0.

deleted 6y ago

[deleted]

revskill 6y ago

Auth is easy, right ? The pain point to me is authorization. Doing authorization correctly is really hard. But most of frameworks i see (open source or closed source) failed at that job.

honksillet 6y ago

Did any employees get screwed when it came to stock options?

spondyl 6y ago

Company realises that they have become kind of slow and that their culture is not conductive to moving fast, innovation and making more money "We could just buy a culture that is" and then either they keep it alive or the original culture destroyed the acquired one and the process starts again? Isn't that like half of acquisitions or maybe I'm being too simplistic, I dunno

TechBro8615 6y ago

> Auth0 is built with a developer first bottoms up acquisition strategy I really wish people would stop saying “bottoms up.” This is what you say when you’re clinking glasses together. The phrase people are looking for here is “bottom up,” as in “up from the bottom of the organization.” So unless they mean they’re starting from a developer’s ass, or preparing to ram their product up a bunch of developers’ exposed bottoms, it would be nice if people learned this expression.