4 ms·

Is there an easy way to get started with SSO on a SAAS app? (Without paying per user on Okta/Auth0) I'm currently using Firebase which supports sign-in with Mi

Is there an easy way to get started with SSO on a SAAS app? (Without paying per user on Okta/Auth0) I'm currently using Firebase which supports sign-in with Microsoft, but not sure if that's technically the same as SSO.

spacemanmatt 4y ago
You might be a great candidate for Keycloak.
- go_prodev 4y ago
  Looks great, thanks for the suggestion
realityking 4y ago
Are you looking to offer SSO to users of your SAAS app? Firebase does support SAML: https://medium.com/@tfalvo/single-sign-on-sso-for-your-firebase-app-with-saml-f67c71e0b4d6 https://medium.com/@tfalvo/single-sign-on-sso-for-your-fireb... Both Microsoft Azure AD and JumpCloud have free plans you can use for testing.
- easton 4y ago
  And Microsoft offers a Microsoft 365 Developer Program which gives you 25 accounts with the maximum license (so Azure AD Premium/Conditional Access/etc) as long as you promise not to use them for prod (and they wipe the tenant every 90 days). https://developer.microsoft.com/en-us/microsoft-365/dev-program https://developer.microsoft.com/en-us/microsoft-365/dev-prog...
aliswe 4y ago
sign-in with Microsoft is indeed SSO.
- nulbyte 4y ago
  "Sign in with..." is almost SSO. Federated authentication employs centralized authentication and can even support third-party identity providers. However, single sign-on is exactly like it sounds: You sign on once and have access to all SSO-enabled applications. This differs from "sign in with..." offerings, because you often have to sign in again. Compare this to, say, the user hub of Google Workspace: You are presented a list of applications, and when you click on one, you are instantly signed into it. This is SSO.
  - deleted 4y ago
    [deleted]
jabroni_salad 4y ago
If you are just testing, grab an AzureAD development account. If you want something more permanant Keycloak is probably your best bet. I'm not aware of any other truly free ones
- mooreds 4y ago
  There are a couple of other free options I'm aware of. * FusionAuth has a community edition which is free as long as you host it yourself and comply with the license ( https://fusionauth.io/license-faq#3 https://fusionauth.io/license-faq#3 ). Free as in beer, at least. (Full disclosure, I work for FusionAuth.) Here's our SSO guide: https://fusionauth.io/docs/v1/tech/guides/single-sign-on https://fusionauth.io/docs/v1/tech/guides/single-sign-on * If you want a SaaS solution, Cognito is an option, as is Azure AD B2C. They have good free tiers, as long as you don't want SAML integration (for Cognito, you're charged after 50 users). * If you want to run your own, you could conceivably cobble something together on whatever tech stack you run. Ruby on rails, java/spring, django/python all have libraries which can be used to build OIDC servers. Then it's a question of setting up the sessions correctly. Here's an example I found via googling: https://tushartuteja.medium.com/a-simple-single-sign-on-sso-using-rails-docker-ff62187b959 https://tushartuteja.medium.com/a-simple-single-sign-on-sso-... * As the parent comment mentioned, Keycloak is an option as well.
  - jbboehr 4y ago
    > The source code for the fusionauth-app bundle and all closed source libraries owned by FusionAuth cannot be decompiled or reverse engineered. This prevents companies from forking FusionAuth and creating their own solution to sell to their customers (i.e. like Amazon has done with ElasticSearch). Is AGPL or one of those new licenses like the BSL not sufficient to prevent this sort of thing?
    - mooreds 4y ago
      I'm not sure why we went with our own license, but we did. The full legalese is here: https://fusionauth.io/license https://fusionauth.io/license
ryancp 4y ago
I am a big fan of Keycloak as it’s been mentioned a few times in previous comments. Maybe this could help someone interested in implementing SSO, but currently working on a full stack starter kit that has Keycloak support/integration included: https://appcket.org https://appcket.org.
deepakprab 4y ago
Please do give SAML Jackson a try, we've married SAML with OAuth2.0 - https://github.com/boxyhq/jackson https://github.com/boxyhq/jackson

spacemanmatt 4y ago

You might be a great candidate for Keycloak.

go_prodev 4y ago
Looks great, thanks for the suggestion

realityking 4y ago

Are you looking to offer SSO to users of your SAAS app? Firebase does support SAML: https://medium.com/@tfalvo/single-sign-on-sso-for-your-firebase-app-with-saml-f67c71e0b4d6 https://medium.com/@tfalvo/single-sign-on-sso-for-your-fireb... Both Microsoft Azure AD and JumpCloud have free plans you can use for testing.

easton 4y ago
And Microsoft offers a Microsoft 365 Developer Program which gives you 25 accounts with the maximum license (so Azure AD Premium/Conditional Access/etc) as long as you promise not to use them for prod (and they wipe the tenant every 90 days). https://developer.microsoft.com/en-us/microsoft-365/dev-program https://developer.microsoft.com/en-us/microsoft-365/dev-prog...

aliswe 4y ago

sign-in with Microsoft is indeed SSO.

nulbyte 4y ago
"Sign in with..." is almost SSO. Federated authentication employs centralized authentication and can even support third-party identity providers. However, single sign-on is exactly like it sounds: You sign on once and have access to all SSO-enabled applications. This differs from "sign in with..." offerings, because you often have to sign in again. Compare this to, say, the user hub of Google Workspace: You are presented a list of applications, and when you click on one, you are instantly signed into it. This is SSO.
- deleted 4y ago
  [deleted]

jabroni_salad 4y ago

If you are just testing, grab an AzureAD development account. If you want something more permanant Keycloak is probably your best bet. I'm not aware of any other truly free ones

mooreds 4y ago
There are a couple of other free options I'm aware of. * FusionAuth has a community edition which is free as long as you host it yourself and comply with the license ( https://fusionauth.io/license-faq#3 https://fusionauth.io/license-faq#3 ). Free as in beer, at least. (Full disclosure, I work for FusionAuth.) Here's our SSO guide: https://fusionauth.io/docs/v1/tech/guides/single-sign-on https://fusionauth.io/docs/v1/tech/guides/single-sign-on * If you want a SaaS solution, Cognito is an option, as is Azure AD B2C. They have good free tiers, as long as you don't want SAML integration (for Cognito, you're charged after 50 users). * If you want to run your own, you could conceivably cobble something together on whatever tech stack you run. Ruby on rails, java/spring, django/python all have libraries which can be used to build OIDC servers. Then it's a question of setting up the sessions correctly. Here's an example I found via googling: https://tushartuteja.medium.com/a-simple-single-sign-on-sso-using-rails-docker-ff62187b959 https://tushartuteja.medium.com/a-simple-single-sign-on-sso-... * As the parent comment mentioned, Keycloak is an option as well.
- jbboehr 4y ago
  > The source code for the fusionauth-app bundle and all closed source libraries owned by FusionAuth cannot be decompiled or reverse engineered. This prevents companies from forking FusionAuth and creating their own solution to sell to their customers (i.e. like Amazon has done with ElasticSearch). Is AGPL or one of those new licenses like the BSL not sufficient to prevent this sort of thing?
  - mooreds 4y ago
    I'm not sure why we went with our own license, but we did. The full legalese is here: https://fusionauth.io/license https://fusionauth.io/license

ryancp 4y ago

I am a big fan of Keycloak as it’s been mentioned a few times in previous comments. Maybe this could help someone interested in implementing SSO, but currently working on a full stack starter kit that has Keycloak support/integration included: https://appcket.org https://appcket.org.

deepakprab 4y ago

Please do give SAML Jackson a try, we've married SAML with OAuth2.0 - https://github.com/boxyhq/jackson https://github.com/boxyhq/jackson