6 ms·
I had to use Okta at a company once. I asked myself the very same question you posed, every single day.
by nefitty 5y ago
I had to use Okta at a company once. I asked myself the very same question you posed, every single day.
- vosper 5y agoIs MS auth better? Does that mean Active Directory? We're in the middle of a migration from in-house auth (which we need to get rid off) to Okta and I think the people involved are finding Okta pretty confusing. But it's a big product and auth stuff is complicated, so I'm not sure how much it's Okta's fault.
- vladvasiliu 5y agoIn the context of Okta it's probably AzureAD. But yes, it's related to Active Directory, you can easily sync the two. It's probably why many companies use it: it's easy to add on to your existing Windows infrastructure. My client uses it, it works mostly well. It does have its annoying limitations, though, such as no group inheritance and limited support for hardware tokens outside of Windows (no support on Safari/iOS, Safari/macOS, Firefox/Linux).
- count 5y agoWhat do you mean hardware tokens outside of windows? For primary workstation authentication? Or AzureAD auth? By hardware tokens do you mean RSA or TOTP hardware fobs?
- vladvasiliu 5y agoI mean for AzureAD auth, so for "applications", as in OAuth/OIDC. Although I'd like to be able to use the key for primary workstation auth, as I can do on Linux. By hardware tokens I mean U2F, in my case a Yubikey.
- count 5y agoAAD allows you to use FIDO2 for OIDC, with specific browsers being support cross-platform: https://docs.microsoft.com/en-us/azure/active-directory/authentication/fido2-compatibility https://docs.microsoft.com/en-us/azure/active-directory/auth... It's not 'u2f' exactly, but better (imho) for most people.
- vladvasiliu 5y ago> with specific browsers being support cross-platform This is why I said support was "limited". Basically, only Chrome is supported cross-platform, which I don't use anywhere.
- r00fus 5y agoAdd to that, based on the numerous implementations I've seen of Azure AD, Microsoft doesn't have a sandbox/preview instance (or it's cost prohibitive), so testing it with your app before going live with your new app is ... challenging. Okta does provide one at a reasonable cost, so it's easier to test with your new app deployments.
- vladvasiliu 5y ago> Add to that, based on the numerous implementations I've seen of Azure AD, Microsoft doesn't have a sandbox/preview instance (or it's cost prohibitive), so testing it with your app before going live with your new app is ... challenging. I haven't seen any sandbox feature either. The way we handle this is by creating a "test" app if it requires special rights, so we end up with SomeApp-test and SomeApp-prod. I don't know if there's any limit on the number of "apps" you can have.
- janstice 5y agoWe are big in AzureAD (and getting bigger) and this is how we do it, otherwise our non prod systems will need non-prod UAT users, and when the cloud AD is tied to on prem traditional AD, that’s really hard for non-technical users to test (but we do have a test AD/AzureAD for testing changes to the directory itself).
- technion 5y agoIn general I'd say yes. AD syncs to Azure totally painlessly and MFA "just works" if you turn it on.
- marcinzm 5y agoI've used Okta at two companies now and I found it fairly pleasant. Most issues were around people getting locked out in my experience.