6 ms·

But Okta is just hosted SAML or OIDC. The same can be achieved with self-hosted Keycloak. In fact, a third-party’s “Okta integration” should work out of the bo

But Okta is just hosted SAML or OIDC. The same can be achieved with self-hosted Keycloak. In fact, a third-party’s “Okta integration” should work out of the box with Keycloak or any other IdP.

jiveturkey 5y ago
It's not just that. The most important part of Okta is the directory integration, not the SSO part. For small companies that have never acquired anyone, it doesn't matter. It also makes user lifecycle someone else's problem. Very important. As a medium and larger sized company, when you have to tell your customers your homegrown IAM was pwned, you're in for a world of hurt. When you're just in the boat with everyone else who got popped, it's an easily recoverable incident.
- ownagefool 5y ago
  If you have any sort of footprint, it's pretty much expected you'd have protective monitoring so you can articulate what these pwned accounts have actually achieved on your infrastructure. It doesn't really matter who runs your auth service, if the auth service getting pwned results in a reportable attack, you're in for a world of hurt. The next step is to articulate why this isn't your fault and that you did everything you reasonbly could have done to not get pwned. Do you have evidence to support you did your due dilligance on your provider?
paxys 5y ago
No, Okta also supports various forms of 2FA/MFA, Active Directory integration, LDAP and SCIM user provisioning. Not to mention the fact that even if there are open source alternatives out there, setting up servers, configuring them correctly and managing/updating them isn't exactly a simple enough operation for the average company admin.
- compsciphd 5y ago
  for companies that are alrady gsuite users, what does okta provide over what one can get with gsuite saml integration?
  - paranoidrobot 5y ago
    GSuite's SCIM options are lacking. So for example if you want to use AWS SSO tied to GSuite, you have to manually manage users, group membership, etc inside AWS SSO. Similarly for a bunch of other products. A couple of companies I've worked for now use GSuite as their primary accounts, and while a ton of things authenticate through GSuite (either as a built-in integration, or as SAML) - when you onboard/offboard users it involves going into a bunch of different systems to create/invite, set up group memberships, and then later deactivate accounts. We're still considering Okta to solve all that workflow stuff. Yes, even after this event. I believe Okta can also do custom security flows that GSuite can't. So, if you're on a trusted device+network, then you might not need a 2FA challenge. Or conversely if you're trying to access a sensitive service - then always require a 2FA challenge every X hours.
    - compsciphd 5y ago
      yes my company makes us do the 2FA every 9 hours for github (so annoying) via okta, though apparently our gsuite logins via okta are much longer lived. though that sort of answers a followup Q, it would seem that there would be a market that punts the authentication to gsuite's saml, but automates the user creation and the like on the different services (and deactivation), but one still wouldn't have the "custom flows" as you said. but if the custom flows aren't that important, I'd rather trust google to handle my authentication than okta, and in my pseudo-okta without authentication scenario, even access to my pseudo-okta would authenticate via google.
- beachy 5y ago
  > even if there are open source alternatives out there This reads to me like you are unfamiliar with keycloak, which is a very mature and capable solution with plenty of support for everything you mention other than SCIM. Hosting it is not overly challenging, running it in a container would suffice for most companies. Updates are in my experience a smooth process. I'm not claiming it's as easy as an "auth as a service" platform, but as we see, that comes with its own costs.
- ownagefool 5y ago
  Keycloak supports 2FA/MFA, Active Directory, LDAP. You might need a plugin for SCIM, but it does a whole load of other wonderful things, and it doesn't cost $2 per user per month. You will have to find someone to host and patch it, but we shouldn't pretend it's up there with write your own crypto. Using saas is fine too. Often there cheaper than hiring a person until you need said person anyway, and at that point they're just a single point of failure, and people do underestimate the effort to run a production service well. But we shouldn't be so anti-intellectual that we pretend that it's the only way to do things, and that well supported foss products don't exist.
- matt123456789 5y ago
  Keycloak has nearly all of this built in. You don’t need to be a crack sysadmin to set it up. If all you need is a 2FA-enabled OIDC endpoint federating to AD/LDAP to serve as SSO you can be up and running quite quickly. [1] 2FA/Time based OTP: https://www.keycloak.org/docs/12.0/server_admin/keycloak-images/otp-policy.png https://www.keycloak.org/docs/12.0/server_admin/keycloak-ima... [2] LDAP/AD (Kerberos) https://dmc.datical.com/z_resources/images/assets/screenshots/administer/keycloak-ldap.png https://dmc.datical.com/z_resources/images/assets/screenshot... [3] SCIM (third party) https://github.com/Captain-P-Goldfish/scim-for-keycloak https://github.com/Captain-P-Goldfish/scim-for-keycloak
  - paranoidrobot 5y ago
    Re SCIM: That plugin is adding a SCIM provider to Keycloak. i.e provisioning/managing users in KeyCloak Most of the time I'm talking about SCIM outbound, so provisioning/managing users in some other random service (like Trello, Github, whatever). That's the major value-add for Okta.
    - matt123456789 5y ago
      I see. Thank you for clarifying. Here’s the author of the Keycloak SCIM plugin on that functionality: https://stackoverflow.com/questions/58566587/does-keycloak-support-scim#comment124235777_61884365 https://stackoverflow.com/questions/58566587/does-keycloak-s... So will likely require some changes to Keycloak internals in order to address that reliability issue, which will enable building a reliable interface for your use case.
ryan_lane 5y ago
Yes, you can achieve that specific part with Keycloak, and you may end up owned in a different, but equally awful way: https://www.keycloak.org/2021/12/cve https://www.keycloak.org/2021/12/cve There's nothing wrong with Keycloak, and me pointing at this CVE isn't meant as a gotcha. The point is that just because you're doing it yourself doesn't mean you're going to have better protection. Doing this well is difficult. Okta is a security company, and due to a well-organized, well-funded attacker, they were able to be breached. If a similar attacker is trying to breach you, you're likely going to get breached.
- mbreese 5y ago
  > If a similar attacker is trying to breach you, you're likely going to get breached. I think the logic here is accepting that if an attacker is trying to breach you, you’re likely going to get breached. But, if an attacker is trying to breach someone else, you’re still safe(-ish). With a centralized service, you don’t have to be the target to feel the effect.
- darkwater 5y ago
  But are $YOU, as one of the tens of thousand $YOU companies going to be spear headed in a dedicated, not automated way? Maybe, but I would say there is at least one or even two orders of magnitude difference with Okta or other well-known companies.
  - ivan_gammel 5y ago
    There's a cost efficiency point where this argument becomes valid. At small company sizes, where dedicated security team or an admin with sufficient expertise to do proper setup is unaffordable, risk of Okta breach is lower than risk of automated custom setup breach. When you are big enough to deploy self-hosted solution and maintain it for reasonable cost, then yes, I would agree with you, self-hosted setup may reduce risks. When does that happen? When your company has over 1000 people (to break even with your Okta spending) or when your revenue per employee is high enough to spend every year 200-300k€ just on security.

But Okta is just hosted SAML or OIDC. The same can be achieved with self-hosted Keycloak. In fact, a third-party’s “Okta integration” should work out of the box with Keycloak or any other IdP.

jiveturkey 5y ago

It's not just that. The most important part of Okta is the directory integration, not the SSO part. For small companies that have never acquired anyone, it doesn't matter. It also makes user lifecycle someone else's problem. Very important. As a medium and larger sized company, when you have to tell your customers your homegrown IAM was pwned, you're in for a world of hurt. When you're just in the boat with everyone else who got popped, it's an easily recoverable incident.

ownagefool 5y ago
If you have any sort of footprint, it's pretty much expected you'd have protective monitoring so you can articulate what these pwned accounts have actually achieved on your infrastructure. It doesn't really matter who runs your auth service, if the auth service getting pwned results in a reportable attack, you're in for a world of hurt. The next step is to articulate why this isn't your fault and that you did everything you reasonbly could have done to not get pwned. Do you have evidence to support you did your due dilligance on your provider?

paxys 5y ago

No, Okta also supports various forms of 2FA/MFA, Active Directory integration, LDAP and SCIM user provisioning. Not to mention the fact that even if there are open source alternatives out there, setting up servers, configuring them correctly and managing/updating them isn't exactly a simple enough operation for the average company admin.

compsciphd 5y ago
for companies that are alrady gsuite users, what does okta provide over what one can get with gsuite saml integration?
- paranoidrobot 5y ago
  GSuite's SCIM options are lacking. So for example if you want to use AWS SSO tied to GSuite, you have to manually manage users, group membership, etc inside AWS SSO. Similarly for a bunch of other products. A couple of companies I've worked for now use GSuite as their primary accounts, and while a ton of things authenticate through GSuite (either as a built-in integration, or as SAML) - when you onboard/offboard users it involves going into a bunch of different systems to create/invite, set up group memberships, and then later deactivate accounts. We're still considering Okta to solve all that workflow stuff. Yes, even after this event. I believe Okta can also do custom security flows that GSuite can't. So, if you're on a trusted device+network, then you might not need a 2FA challenge. Or conversely if you're trying to access a sensitive service - then always require a 2FA challenge every X hours.
  - compsciphd 5y ago
    yes my company makes us do the 2FA every 9 hours for github (so annoying) via okta, though apparently our gsuite logins via okta are much longer lived. though that sort of answers a followup Q, it would seem that there would be a market that punts the authentication to gsuite's saml, but automates the user creation and the like on the different services (and deactivation), but one still wouldn't have the "custom flows" as you said. but if the custom flows aren't that important, I'd rather trust google to handle my authentication than okta, and in my pseudo-okta without authentication scenario, even access to my pseudo-okta would authenticate via google.
beachy 5y ago
> even if there are open source alternatives out there This reads to me like you are unfamiliar with keycloak, which is a very mature and capable solution with plenty of support for everything you mention other than SCIM. Hosting it is not overly challenging, running it in a container would suffice for most companies. Updates are in my experience a smooth process. I'm not claiming it's as easy as an "auth as a service" platform, but as we see, that comes with its own costs.
ownagefool 5y ago
Keycloak supports 2FA/MFA, Active Directory, LDAP. You might need a plugin for SCIM, but it does a whole load of other wonderful things, and it doesn't cost $2 per user per month. You will have to find someone to host and patch it, but we shouldn't pretend it's up there with write your own crypto. Using saas is fine too. Often there cheaper than hiring a person until you need said person anyway, and at that point they're just a single point of failure, and people do underestimate the effort to run a production service well. But we shouldn't be so anti-intellectual that we pretend that it's the only way to do things, and that well supported foss products don't exist.
matt123456789 5y ago
Keycloak has nearly all of this built in. You don’t need to be a crack sysadmin to set it up. If all you need is a 2FA-enabled OIDC endpoint federating to AD/LDAP to serve as SSO you can be up and running quite quickly. [1] 2FA/Time based OTP: https://www.keycloak.org/docs/12.0/server_admin/keycloak-images/otp-policy.png https://www.keycloak.org/docs/12.0/server_admin/keycloak-ima... [2] LDAP/AD (Kerberos) https://dmc.datical.com/z_resources/images/assets/screenshots/administer/keycloak-ldap.png https://dmc.datical.com/z_resources/images/assets/screenshot... [3] SCIM (third party) https://github.com/Captain-P-Goldfish/scim-for-keycloak https://github.com/Captain-P-Goldfish/scim-for-keycloak
- paranoidrobot 5y ago
  Re SCIM: That plugin is adding a SCIM provider to Keycloak. i.e provisioning/managing users in KeyCloak Most of the time I'm talking about SCIM outbound, so provisioning/managing users in some other random service (like Trello, Github, whatever). That's the major value-add for Okta.
  - matt123456789 5y ago
    I see. Thank you for clarifying. Here’s the author of the Keycloak SCIM plugin on that functionality: https://stackoverflow.com/questions/58566587/does-keycloak-support-scim#comment124235777_61884365 https://stackoverflow.com/questions/58566587/does-keycloak-s... So will likely require some changes to Keycloak internals in order to address that reliability issue, which will enable building a reliable interface for your use case.

ryan_lane 5y ago

Yes, you can achieve that specific part with Keycloak, and you may end up owned in a different, but equally awful way: https://www.keycloak.org/2021/12/cve https://www.keycloak.org/2021/12/cve There's nothing wrong with Keycloak, and me pointing at this CVE isn't meant as a gotcha. The point is that just because you're doing it yourself doesn't mean you're going to have better protection. Doing this well is difficult. Okta is a security company, and due to a well-organized, well-funded attacker, they were able to be breached. If a similar attacker is trying to breach you, you're likely going to get breached.

mbreese 5y ago
> If a similar attacker is trying to breach you, you're likely going to get breached. I think the logic here is accepting that if an attacker is trying to breach you, you’re likely going to get breached. But, if an attacker is trying to breach someone else, you’re still safe(-ish). With a centralized service, you don’t have to be the target to feel the effect.
darkwater 5y ago
But are $YOU, as one of the tens of thousand $YOU companies going to be spear headed in a dedicated, not automated way? Maybe, but I would say there is at least one or even two orders of magnitude difference with Okta or other well-known companies.
- ivan_gammel 5y ago
  There's a cost efficiency point where this argument becomes valid. At small company sizes, where dedicated security team or an admin with sufficient expertise to do proper setup is unaffordable, risk of Okta breach is lower than risk of automated custom setup breach. When you are big enough to deploy self-hosted solution and maintain it for reasonable cost, then yes, I would agree with you, self-hosted setup may reduce risks. When does that happen? When your company has over 1000 people (to break even with your Okta spending) or when your revenue per employee is high enough to spend every year 200-300k€ just on security.