48 ms·

My dream is to one day create an SSO solution for companies. I've been doing research for a time being, but I am worried that I wouldn't find any clients, becau

My dream is to one day create an SSO solution for companies. I've been doing research for a time being, but I am worried that I wouldn't find any clients, because who would trust an SSO created by one guy in his basement? I think the first step to overcome that would be having a completely Open Source solution, but how to avoid other companies grabbing it and selling as their own? Or do you think it is better to develop it anyway and then worry about customers later?

saberdancer 6y ago
There is already Keycloak and various vendor solutions. I feel you'll struggle to break through.
herodoturtle 6y ago
> because who would trust an SSO created by one guy in his basement? If you think you've got a good idea and a unique proposition - and your technical skills are up to scratch - then don't worry about starting out from your basement. Have a look at Thawte Consulting - a certificate authority founded by Mark Shuttleworth in his parents' garage - which he later sold to Verisign for $575 million dollars: https://en.wikipedia.org/wiki/Thawte https://en.wikipedia.org/wiki/Thawte Starting a "high trust" business from one's basement is perfectly fine. That being said, a far more important point is testing / validating the existence of an actual market for your product. Whether you build your solution out of your basement or a lavish penthouse office is irrelevant. The best and brightest team working out of swank office space will still fail if the market for their product doesn't exist. Hope that helps :-)
martin-adams 6y ago
Personally, I think the answer has to come from your customers. If the pain you're solving is great enough that they want it, but the only showstopper is future-proofing, then you might be able to work with them to find a solution. It might be a case that you deploy into their infrastructure and give them a licence to use the source code should you shut down.
3np 6y ago
The current business players in the space all range across the spectrum of closed blackbox Saas (Auth0) to open core / open source (HC Boundary, arguably) Before you can answer that - how do you differentiate from the existing competition? What's your target customer?
candiddevmike 6y ago
Would love to hear more about this, I've got a couple of design diagrams and thoughts on my "ideal SSO setup". My contact info is in my profile.
traverseda 6y ago
The smaller scale homelab/selfhosting people really need a better solution. I think open source developers do as well. What we really need is a small easy to set up solution that provides a clear way for us to integrate our app into it. My ideal would be something that * Supports ldap and OIDC * Can be deployed to docker using one compose file * Only needs to support hundreds of users (keep it simple, easy to deploy, and able to run on a raspberry pi) * Provides basic user management, I want to be able to put users into groups and (if the app supports it) use those groups for in-app ACL. If that service worked well in my homelab (a single-pc docker swarm that runs a few private web services like jellyfin) I'd very likely end up deploying it on my employers infrastructure. My employer is a small business with maybe ~30 users. I'm not sure how to convert something like that into sales though. Still, starting with an open-source solution that solves problems for the little guys often has a "trickle up" effect. Right now I'm looking towards https://github.com/sonicnkt/glauth-ui/ https://github.com/sonicnkt/glauth-ui/ to solve that problem, but it's definitely not anywhere near there yet.
- red0point 6y ago
  I think Keycloak ticks all those boxed rather nicely. While it does support more than a few hundred users, I doubt that this will be a serious issue. Perhaps you could enlighten us with a few key differentiators of your ideal solution to other common ones?
  - traverseda 6y ago
    Wait, does keycloak have an integrated LDAP server?
    - red0point 6y ago
      No. You can use any LDAP server as a backing store for your users.
- znpy 6y ago
  Uhm, keycloak does all the things you name and more. I have it in production at work. Three instances, clustered (infinispan), running in docker containers orchestrated by kubernetes. Each instance (pod) is upper-limited to 2gb ram (or 3, can't recall the details now). It works very well and very reliably, serving about 750 users (as in, real people). If you have 2GB to spare and a physical core, you can run keycloak with no problems at all. After all, it all depends on the amount of traffic. Little traffic = little cpu load. Don't dismiss keycloak because it's written in Java... Quite the contrary, you can tune the JVM to work with little memory (-Xms -Xmx iirc). Ten years ago it was very common to see tips and tricks to make grails web apps work on as little as 64mb of ram on chap VPSes.
Hitton 6y ago
>because who would trust an SSO created by one guy in his basement You don't have to tell everyone that you are one person company operating from basement. Why not use phrases like "our company", "our clients", have different email addresses like support@, sales@, hr@ subtly insinuating there are more of you, use picture from photobank when listing address of your company's headquarters(basement) etc.. You won't be first nor last person doing this. And Open Source/Proprietary doesn't need to be either/or problem. You can dual license it as AGPL/Proprietary and make contributors sign CLA.
1cvmask 6y ago
What will be different to other solutions?
znpy 6y ago
Keep dreaming! In the meantime people are already offering managed keycloak instances as a service.
- isaacpz 6y ago
  Who’s offering managed keycloak as a service? I’ve only come across cloud-iam whose security page didn’t impress me
  - znpy 6y ago
    cloud-iam. they look fine, and they look like they already have customers.

saberdancer 6y ago

There is already Keycloak and various vendor solutions. I feel you'll struggle to break through.

herodoturtle 6y ago

> because who would trust an SSO created by one guy in his basement? If you think you've got a good idea and a unique proposition - and your technical skills are up to scratch - then don't worry about starting out from your basement. Have a look at Thawte Consulting - a certificate authority founded by Mark Shuttleworth in his parents' garage - which he later sold to Verisign for $575 million dollars: https://en.wikipedia.org/wiki/Thawte https://en.wikipedia.org/wiki/Thawte Starting a "high trust" business from one's basement is perfectly fine. That being said, a far more important point is testing / validating the existence of an actual market for your product. Whether you build your solution out of your basement or a lavish penthouse office is irrelevant. The best and brightest team working out of swank office space will still fail if the market for their product doesn't exist. Hope that helps :-)

martin-adams 6y ago

Personally, I think the answer has to come from your customers. If the pain you're solving is great enough that they want it, but the only showstopper is future-proofing, then you might be able to work with them to find a solution. It might be a case that you deploy into their infrastructure and give them a licence to use the source code should you shut down.

3np 6y ago

The current business players in the space all range across the spectrum of closed blackbox Saas (Auth0) to open core / open source (HC Boundary, arguably) Before you can answer that - how do you differentiate from the existing competition? What's your target customer?

candiddevmike 6y ago

Would love to hear more about this, I've got a couple of design diagrams and thoughts on my "ideal SSO setup". My contact info is in my profile.

traverseda 6y ago

The smaller scale homelab/selfhosting people really need a better solution. I think open source developers do as well. What we really need is a small easy to set up solution that provides a clear way for us to integrate our app into it. My ideal would be something that * Supports ldap and OIDC * Can be deployed to docker using one compose file * Only needs to support hundreds of users (keep it simple, easy to deploy, and able to run on a raspberry pi) * Provides basic user management, I want to be able to put users into groups and (if the app supports it) use those groups for in-app ACL. If that service worked well in my homelab (a single-pc docker swarm that runs a few private web services like jellyfin) I'd very likely end up deploying it on my employers infrastructure. My employer is a small business with maybe ~30 users. I'm not sure how to convert something like that into sales though. Still, starting with an open-source solution that solves problems for the little guys often has a "trickle up" effect. Right now I'm looking towards https://github.com/sonicnkt/glauth-ui/ https://github.com/sonicnkt/glauth-ui/ to solve that problem, but it's definitely not anywhere near there yet.

red0point 6y ago
I think Keycloak ticks all those boxed rather nicely. While it does support more than a few hundred users, I doubt that this will be a serious issue. Perhaps you could enlighten us with a few key differentiators of your ideal solution to other common ones?
- traverseda 6y ago
  Wait, does keycloak have an integrated LDAP server?
  - red0point 6y ago
    No. You can use any LDAP server as a backing store for your users.
znpy 6y ago
Uhm, keycloak does all the things you name and more. I have it in production at work. Three instances, clustered (infinispan), running in docker containers orchestrated by kubernetes. Each instance (pod) is upper-limited to 2gb ram (or 3, can't recall the details now). It works very well and very reliably, serving about 750 users (as in, real people). If you have 2GB to spare and a physical core, you can run keycloak with no problems at all. After all, it all depends on the amount of traffic. Little traffic = little cpu load. Don't dismiss keycloak because it's written in Java... Quite the contrary, you can tune the JVM to work with little memory (-Xms -Xmx iirc). Ten years ago it was very common to see tips and tricks to make grails web apps work on as little as 64mb of ram on chap VPSes.

Hitton 6y ago

>because who would trust an SSO created by one guy in his basement You don't have to tell everyone that you are one person company operating from basement. Why not use phrases like "our company", "our clients", have different email addresses like support@, sales@, hr@ subtly insinuating there are more of you, use picture from photobank when listing address of your company's headquarters(basement) etc.. You won't be first nor last person doing this. And Open Source/Proprietary doesn't need to be either/or problem. You can dual license it as AGPL/Proprietary and make contributors sign CLA.

1cvmask 6y ago

What will be different to other solutions?

znpy 6y ago

Keep dreaming! In the meantime people are already offering managed keycloak instances as a service.

isaacpz 6y ago
Who’s offering managed keycloak as a service? I’ve only come across cloud-iam whose security page didn’t impress me
- znpy 6y ago
  cloud-iam. they look fine, and they look like they already have customers.