3 ms·

Is there an alternative to OKTA for managing sso access for a hundred users with second factor across a couple dozen websites?

by bagels 4y ago

justusw 4y ago
Are you talking about customer facing SSO?
- bagels 4y ago
  I'm talking about my company uses jira, git, aws, etc., and I'd like to centrally enforce SSO + yubikeys.
  - justusw 4y ago
    This is just my personal opinion and after evaluating it from a compatibility angle I found that Azure AD is suitable. We are using it with Nextcloud, Apple Business Manager, Tailscale and Figma. U2F is not well supported, but OTP works well (with yubico auth as well of course.
mdtusz 4y ago
I'm sure many will disagree, but just implement it yourself if you're an SP. If you're using a common web framework, there's almost certainly packages/plugins that will manage SSO and 2fa, and despite the constant fud, dealing with user accounts really isn't all that hard. More importantly, understanding the mechanics of your user account system will pay dividends as your product grows and new authN/Z requirements arise.
- bagels 4y ago
  Apologies that my question wasn't clear enough. I am building a remote company and we use a ton of products. I'd like centralized authentication + sso + ability to enforce yubikeys for AWS, Jira Cloud, Bitbucket, and a ton of others that OKTA supports for SSO.
  - jf 4y ago
    (Disclaimer: I’m an Okta employee) Okta works really well in your use case. I recommend trying it out yourself. Since you mention YubiKeys, I’d also suggest that you try removing passwords from your setup entirely by using YubiKeys and one or more other factors. If you don’t want to use Okta, I’m also happy to give you my take on the alternatives to consider. Feel free to reach out to me directly.
  - mdtusz 4y ago
    Azure Active Directory manages this well. If your company uses office365, it's likely you already are using this under the hood.
xander158 4y ago
There are many alternatives like CyberArk, OneLogin, Ping Identity and others.
sascha_sl 4y ago
If you want to self-host, Keycloak. You can then either find OIDC/SAML integrations for your systems or use something like Pomerium to add authentication via a proxy. Just remember that properly upgrading Keycloak without downtime is nearly impossible without booting up a second instance on a clone of your database and moving traffic over there, so if you have anything that needs to work 24/7, wait for HA upgrades feature that's supposedly coming soon.
kache_ 4y ago
WorkOS

Is there an alternative to OKTA for managing sso access for a hundred users with second factor across a couple dozen websites?

by bagels 4y ago

Is there an alternative to OKTA for managing sso access for a hundred users with second factor across a couple dozen websites?

justusw 4y ago

Are you talking about customer facing SSO?

bagels 4y ago
I'm talking about my company uses jira, git, aws, etc., and I'd like to centrally enforce SSO + yubikeys.
- justusw 4y ago
  This is just my personal opinion and after evaluating it from a compatibility angle I found that Azure AD is suitable. We are using it with Nextcloud, Apple Business Manager, Tailscale and Figma. U2F is not well supported, but OTP works well (with yubico auth as well of course.

mdtusz 4y ago

I'm sure many will disagree, but just implement it yourself if you're an SP. If you're using a common web framework, there's almost certainly packages/plugins that will manage SSO and 2fa, and despite the constant fud, dealing with user accounts really isn't all that hard. More importantly, understanding the mechanics of your user account system will pay dividends as your product grows and new authN/Z requirements arise.

bagels 4y ago
Apologies that my question wasn't clear enough. I am building a remote company and we use a ton of products. I'd like centralized authentication + sso + ability to enforce yubikeys for AWS, Jira Cloud, Bitbucket, and a ton of others that OKTA supports for SSO.
- jf 4y ago
  (Disclaimer: I’m an Okta employee) Okta works really well in your use case. I recommend trying it out yourself. Since you mention YubiKeys, I’d also suggest that you try removing passwords from your setup entirely by using YubiKeys and one or more other factors. If you don’t want to use Okta, I’m also happy to give you my take on the alternatives to consider. Feel free to reach out to me directly.
- mdtusz 4y ago
  Azure Active Directory manages this well. If your company uses office365, it's likely you already are using this under the hood.

xander158 4y ago

There are many alternatives like CyberArk, OneLogin, Ping Identity and others.

sascha_sl 4y ago

If you want to self-host, Keycloak. You can then either find OIDC/SAML integrations for your systems or use something like Pomerium to add authentication via a proxy. Just remember that properly upgrading Keycloak without downtime is nearly impossible without booting up a second instance on a clone of your database and moving traffic over there, so if you have anything that needs to work 24/7, wait for HA upgrades feature that's supposedly coming soon.

kache_ 4y ago

WorkOS