9 ms·

What was the business rationale for such switch? I usually see people migrate toward MS auth not away from it.

by polskibus 5y ago

nefitty 5y ago
I had to use Okta at a company once. I asked myself the very same question you posed, every single day.
- vosper 5y ago
  Is MS auth better? Does that mean Active Directory? We're in the middle of a migration from in-house auth (which we need to get rid off) to Okta and I think the people involved are finding Okta pretty confusing. But it's a big product and auth stuff is complicated, so I'm not sure how much it's Okta's fault.
  - vladvasiliu 5y ago
    In the context of Okta it's probably AzureAD. But yes, it's related to Active Directory, you can easily sync the two. It's probably why many companies use it: it's easy to add on to your existing Windows infrastructure. My client uses it, it works mostly well. It does have its annoying limitations, though, such as no group inheritance and limited support for hardware tokens outside of Windows (no support on Safari/iOS, Safari/macOS, Firefox/Linux).
    - count 5y ago
      What do you mean hardware tokens outside of windows? For primary workstation authentication? Or AzureAD auth? By hardware tokens do you mean RSA or TOTP hardware fobs?
      - vladvasiliu 5y ago
        I mean for AzureAD auth, so for "applications", as in OAuth/OIDC. Although I'd like to be able to use the key for primary workstation auth, as I can do on Linux. By hardware tokens I mean U2F, in my case a Yubikey.
        count 5y ago
        AAD allows you to use FIDO2 for OIDC, with specific browsers being support cross-platform: https://docs.microsoft.com/en-us/azure/active-directory/authentication/fido2-compatibility https://docs.microsoft.com/en-us/azure/active-directory/auth... It's not 'u2f' exactly, but better (imho) for most people.
        vladvasiliu 5y ago
        > with specific browsers being support cross-platform This is why I said support was "limited". Basically, only Chrome is supported cross-platform, which I don't use anywhere.
    - r00fus 5y ago
      Add to that, based on the numerous implementations I've seen of Azure AD, Microsoft doesn't have a sandbox/preview instance (or it's cost prohibitive), so testing it with your app before going live with your new app is ... challenging. Okta does provide one at a reasonable cost, so it's easier to test with your new app deployments.
      - vladvasiliu 5y ago
        > Add to that, based on the numerous implementations I've seen of Azure AD, Microsoft doesn't have a sandbox/preview instance (or it's cost prohibitive), so testing it with your app before going live with your new app is ... challenging. I haven't seen any sandbox feature either. The way we handle this is by creating a "test" app if it requires special rights, so we end up with SomeApp-test and SomeApp-prod. I don't know if there's any limit on the number of "apps" you can have.
        janstice 5y ago
        We are big in AzureAD (and getting bigger) and this is how we do it, otherwise our non prod systems will need non-prod UAT users, and when the cloud AD is tied to on prem traditional AD, that’s really hard for non-technical users to test (but we do have a test AD/AzureAD for testing changes to the directory itself).
  - technion 5y ago
    In general I'd say yes. AD syncs to Azure totally painlessly and MFA "just works" if you turn it on.
- marcinzm 5y ago
  I've used Okta at two companies now and I found it fairly pleasant. Most issues were around people getting locked out in my experience.
anonymousiam 5y ago
According to our CTO, it was related to security. With Microsoft, the TFA options did not include a hardware token. So now we can authenticate with a phone call, a text message, or a security token. ( https://www.okta.com/identity-101/security-token/ https://www.okta.com/identity-101/security-token/ ) The main advantage is that the hardware token can be used in areas where mobile phones are prohibited, and of course immunity from a SIM swap attack.
- vladvasiliu 5y ago
  They do support hardware tokens. I use a Yubikey with it. However, support is spotty outside of Windows.
  - anonymousiam 5y ago
    There may have been other reasons not mentioned, such as Microsoft's tiered services model. It sometimes seems as if they deliberately provide poor solutions at the lower tiers. The USG is pretty pissed off about that. Also, Yubikey would would not work, because like mobile phones, USB devices are restricted in some areas.
    - vladvasiliu 5y ago
      > Also, Yubikey would would not work, because like mobile phones, USB devices are restricted in some areas. What kind of token would work, then? Something that only generates a TOTP, like those fobs some banks used to give out?
      - anonymousiam 5y ago
        Yes. Same method as Google/Microsoft Authenticator, but implemented in a separate hardware device (fob).
        Closi 5y ago
        Ah, Microsoft has this in public preview at the moment so full support looks imminent.
amw-zero 5y ago
I think that depends on many factors, like where you work, what class of companies you work for, etc. For example, I have not even seen a Windows machine in 10 years at work. I can't think of anyone in my professional circle either who would suggest using any MS product.
- jiggawatts 5y ago
  I saw a Linux machine recently… I think.
oneplane 5y ago
We're moving everything that is still tied to it away from MS. The last products we have to solve are Dynamics and Excel but that scope is so small compared to everything else that it might not matter to leave those as-is for now if we can get at least Dynamics as SaaS and ditch AD (which only remains for Dynamics). MS doesn't do the things we need in a better way than other options, and it's almost always more expensive at product level and TCO level.
- jiggawatts 5y ago
  I’ve found the opposite — as long as you’re happy with staying within the MS ecosystems. So Azure, Office 365, Teams, etc… You hear people calling Microsoft expensive when they’re on some random mix of Gmail, Notes, CM9, or whatever. Then MS seems expensive because it’s all or nothing. Dipping your toe in the water turns into a dive to the bottom of the pool.
  - oneplane 5y ago
    To be honest not a lot of our users and administrators have actually been happy in the MS ecosystem. There are a few outliers, some licensing middlemen, a few MSPs and a couple of hardcore Excel number crunchers that use the Axapta or Dynamics connectors. But you can find those anywhere like with SAS and SPSS. A lot of users don't really care at all so that just makes it a cost and 'does it do the bare minimum'-deal for them. A few people that really invest and enjoy a specific application does not make it great, especially when it turns our they are just doing more than they should be doing; i.e. when you have an InDesign professional that would be typesetting materials for publication but the person that writes the copy is also trying to 'typeset' the source in Word. It's great if you then feel like Word gets you cool typeset documents as a power user, but if 9999 people in a 10k company don't do that and just let the publication team do that properly in InDesign according to the media standards, it's no reason to keep it as a default available application. A lot of the usage comes from "well, it was already there so I went and did it in that". Not because it was actually the standard, best choice or in scope of the task that was supposed to be done. Same goes for things like notes and documentation: - Code-level docs go in the repo (MD, RST mostly) - Org-level docs go in the wiki (Confluence) - Publications are delivered as copy to the publication team which then uses the DTP/typesetting thing of choice Yet someone who would ignore that creates extra work by doing it in a different application first, then copying it around and converting it. That means that the person/process needs to be fixed, and doesn't mean we need Word as an expensive WordPad/Pages replacement. Now, this might not apply to things like mini-orgs inside a bigger org, or very small companies and individuals. But I wasn't writing about those anyway ;-) At that level you don't really have the size and scope to make good choices anyway, and you're best off just sticking with one big vendor, not because they are the best, but because you won't be handling multi-vendor management anyway.

What was the business rationale for such switch? I usually see people migrate toward MS auth not away from it.

nefitty 5y ago

I had to use Okta at a company once. I asked myself the very same question you posed, every single day.

vosper 5y ago
Is MS auth better? Does that mean Active Directory? We're in the middle of a migration from in-house auth (which we need to get rid off) to Okta and I think the people involved are finding Okta pretty confusing. But it's a big product and auth stuff is complicated, so I'm not sure how much it's Okta's fault.
- vladvasiliu 5y ago
  In the context of Okta it's probably AzureAD. But yes, it's related to Active Directory, you can easily sync the two. It's probably why many companies use it: it's easy to add on to your existing Windows infrastructure. My client uses it, it works mostly well. It does have its annoying limitations, though, such as no group inheritance and limited support for hardware tokens outside of Windows (no support on Safari/iOS, Safari/macOS, Firefox/Linux).
  - count 5y ago
    What do you mean hardware tokens outside of windows? For primary workstation authentication? Or AzureAD auth? By hardware tokens do you mean RSA or TOTP hardware fobs?
    - vladvasiliu 5y ago
      I mean for AzureAD auth, so for "applications", as in OAuth/OIDC. Although I'd like to be able to use the key for primary workstation auth, as I can do on Linux. By hardware tokens I mean U2F, in my case a Yubikey.
      - count 5y ago
        AAD allows you to use FIDO2 for OIDC, with specific browsers being support cross-platform: https://docs.microsoft.com/en-us/azure/active-directory/authentication/fido2-compatibility https://docs.microsoft.com/en-us/azure/active-directory/auth... It's not 'u2f' exactly, but better (imho) for most people.
        vladvasiliu 5y ago
        > with specific browsers being support cross-platform This is why I said support was "limited". Basically, only Chrome is supported cross-platform, which I don't use anywhere.
  - r00fus 5y ago
    Add to that, based on the numerous implementations I've seen of Azure AD, Microsoft doesn't have a sandbox/preview instance (or it's cost prohibitive), so testing it with your app before going live with your new app is ... challenging. Okta does provide one at a reasonable cost, so it's easier to test with your new app deployments.
    - vladvasiliu 5y ago
      > Add to that, based on the numerous implementations I've seen of Azure AD, Microsoft doesn't have a sandbox/preview instance (or it's cost prohibitive), so testing it with your app before going live with your new app is ... challenging. I haven't seen any sandbox feature either. The way we handle this is by creating a "test" app if it requires special rights, so we end up with SomeApp-test and SomeApp-prod. I don't know if there's any limit on the number of "apps" you can have.
      - janstice 5y ago
        We are big in AzureAD (and getting bigger) and this is how we do it, otherwise our non prod systems will need non-prod UAT users, and when the cloud AD is tied to on prem traditional AD, that’s really hard for non-technical users to test (but we do have a test AD/AzureAD for testing changes to the directory itself).
- technion 5y ago
  In general I'd say yes. AD syncs to Azure totally painlessly and MFA "just works" if you turn it on.
marcinzm 5y ago
I've used Okta at two companies now and I found it fairly pleasant. Most issues were around people getting locked out in my experience.

anonymousiam 5y ago

According to our CTO, it was related to security. With Microsoft, the TFA options did not include a hardware token. So now we can authenticate with a phone call, a text message, or a security token. ( https://www.okta.com/identity-101/security-token/ https://www.okta.com/identity-101/security-token/ ) The main advantage is that the hardware token can be used in areas where mobile phones are prohibited, and of course immunity from a SIM swap attack.

vladvasiliu 5y ago
They do support hardware tokens. I use a Yubikey with it. However, support is spotty outside of Windows.
- anonymousiam 5y ago
  There may have been other reasons not mentioned, such as Microsoft's tiered services model. It sometimes seems as if they deliberately provide poor solutions at the lower tiers. The USG is pretty pissed off about that. Also, Yubikey would would not work, because like mobile phones, USB devices are restricted in some areas.
  - vladvasiliu 5y ago
    > Also, Yubikey would would not work, because like mobile phones, USB devices are restricted in some areas. What kind of token would work, then? Something that only generates a TOTP, like those fobs some banks used to give out?
    - anonymousiam 5y ago
      Yes. Same method as Google/Microsoft Authenticator, but implemented in a separate hardware device (fob).
      - Closi 5y ago
        Ah, Microsoft has this in public preview at the moment so full support looks imminent.

amw-zero 5y ago

I think that depends on many factors, like where you work, what class of companies you work for, etc. For example, I have not even seen a Windows machine in 10 years at work. I can't think of anyone in my professional circle either who would suggest using any MS product.

jiggawatts 5y ago
I saw a Linux machine recently… I think.

oneplane 5y ago

We're moving everything that is still tied to it away from MS. The last products we have to solve are Dynamics and Excel but that scope is so small compared to everything else that it might not matter to leave those as-is for now if we can get at least Dynamics as SaaS and ditch AD (which only remains for Dynamics). MS doesn't do the things we need in a better way than other options, and it's almost always more expensive at product level and TCO level.

jiggawatts 5y ago
I’ve found the opposite — as long as you’re happy with staying within the MS ecosystems. So Azure, Office 365, Teams, etc… You hear people calling Microsoft expensive when they’re on some random mix of Gmail, Notes, CM9, or whatever. Then MS seems expensive because it’s all or nothing. Dipping your toe in the water turns into a dive to the bottom of the pool.
- oneplane 5y ago
  To be honest not a lot of our users and administrators have actually been happy in the MS ecosystem. There are a few outliers, some licensing middlemen, a few MSPs and a couple of hardcore Excel number crunchers that use the Axapta or Dynamics connectors. But you can find those anywhere like with SAS and SPSS. A lot of users don't really care at all so that just makes it a cost and 'does it do the bare minimum'-deal for them. A few people that really invest and enjoy a specific application does not make it great, especially when it turns our they are just doing more than they should be doing; i.e. when you have an InDesign professional that would be typesetting materials for publication but the person that writes the copy is also trying to 'typeset' the source in Word. It's great if you then feel like Word gets you cool typeset documents as a power user, but if 9999 people in a 10k company don't do that and just let the publication team do that properly in InDesign according to the media standards, it's no reason to keep it as a default available application. A lot of the usage comes from "well, it was already there so I went and did it in that". Not because it was actually the standard, best choice or in scope of the task that was supposed to be done. Same goes for things like notes and documentation: - Code-level docs go in the repo (MD, RST mostly) - Org-level docs go in the wiki (Confluence) - Publications are delivered as copy to the publication team which then uses the DTP/typesetting thing of choice Yet someone who would ignore that creates extra work by doing it in a different application first, then copying it around and converting it. That means that the person/process needs to be fixed, and doesn't mean we need Word as an expensive WordPad/Pages replacement. Now, this might not apply to things like mini-orgs inside a bigger org, or very small companies and individuals. But I wasn't writing about those anyway ;-) At that level you don't really have the size and scope to make good choices anyway, and you're best off just sticking with one big vendor, not because they are the best, but because you won't be handling multi-vendor management anyway.