11 ms·

Show HN: Skip the SSO Tax, access your user data with OSS

220 points by mathiasn 3y ago

As the former CTO of an Insurtech and Fintech startup I always had the “pleasure” to keep regulators and auditors happy. Think of documenting who has access to what, quarterly access reviews, yearly audits and so on… Like many others we couldn’t justify the Enterprise-plan for every SaaS tool to simply get access to SSO and SCIM/SAML APIs. For Notion alone the cost would have nearly doubled to $14 per user per month. That’s insane! Mostly unknown to people, SSO Tax also limits access to APIs that are used for managing user access (SCIM/SAML). This has proven to be an incredibly annoying roadblock that prevented me from doing anything useful with our user data: - You want to download the current list of users and their permissions? Forget about it! - You want to centrally assign user roles and permissions? Good luck with that! - You want to delete user accounts immediately? Yeah right, like that's ever gonna happen! It literally cost me hours to update our access matrix at the end of every quarter for our access reviews and manually assigning user accounts and permissions. I figured, there must be a better way than praying to the SaaS gods to miraculously make the SSO Tax disappear (and open up SCIM/SAML along the way). That’s why I sat down a few weeks ago and started building OpenOwl (https://github.com/AccessOwl/open_owl https://github.com/AccessOwl/open_owl). It allows me to just plug in my user credentials and automatically download user lists, including permissions from SaaS tools. Granted, OpenOwl is still a work in progress, and it's not perfect. At the moment it's limited to non-SSO login flows and covers only 7 SaaS vendors. My favorite part is that you can configure integrations as “recipes”. The goal was for anybody to be able to add new integrations (IT managers and developers alike). Therefore you ideally don’t even have to write any new code, just tell OpenOwl how the new SaaS vendor works. What do you think? Have you dealt with manually maintaining a list of users and their permissions? Could this approach get us closer to overcoming parts of the SSO Tax?

dboreham 3y ago
I recommend some editing of the readme to clarify the tool's purpose. Initially I thought it might be an AI-generated spoof project since the description made no sense. I think the tool is for the following scenario: you are a manager in an organization where some set of your employees are using some specific SaaS (see list of currently supported SaaS'es below). You would like to see a list of the user accounts for your employees within your company's "domain" in said SaaS, along with some account metadata. This tool extracts that info using the SaaS domain management API.
- mathiasn 3y ago
  Oh thanks a lot. I updated the repo description. You're right with what you think though :-)
cheeseblubber 3y ago
The SSO part is a bit confusing since it sounds like the product is letting you download account and permissions data based on your own api key. It might be helpful if you clarify how you can help with the SSO portion of things.
- cj 3y ago
  In a similar vein, I’m confused by the messaging: “SSO is expensive” problem, the “access user data” problem, “centrally manage permissions” problem, and “automatic account provisioning/deprovisioning” problem. The marketing seems to jumble those 4 problems into 1 problem when (at least to me) they’re 4 very distinct problems to solve. That leaves me wondering which of those problems are you truly solving? All 4 or just a subset?
  - mathiasn 3y ago
    Fantastic feedback. Indeed these are distinctive problems. For instance, "SSO is expensive" seems to be the root cause for the "centrally manage permissions" and "automatic account provisioning/deprovisioning" problems. At least when we're not talking about enterprises. OpenOwl tries to give transparency over the user permission data in your SaaS tools - independent whether you have SCIM APIs or not. It's read-only though. No automatic account provisioning here. However, as some of these problems are very close to each other, it could make sense to solve them together. But that's not the intent for OpenOwl.
- mathiasn 3y ago
  That's a good point. Indeed there is a technical focus on login flows at the moment as this seems like the hardest problem to solve. Adding API key flows makes definitely sense though!
lozenge 3y ago
This is cool, in that it might encourage SaaS providers to reduce the SSO tax. Discouraging security affects all of us whose data is held by other companies (ie everybody). I'm sure you'll get comments that you're being penny wise pound foolish and wasting your time with these hacks. That entirely depends on where your company is located. As it supports so few services, putting the list up top in the README would be a good idea, and a quick explanation of what programming languages/methods can be used to add more services. The chances another organisation has picked the same 7 services as you is pretty low.
- mathiasn 3y ago
  I really hope that companies stop putting SSO/SCIM into a separate plan but allow using it in lower plans. Thanks for the idea. That makes sense. We hope that more recipes can be added soon so that there is more coverage for everyone.
londons_explore 3y ago
It'd like some kind of chrome extension that will 'sso-ize' any 3rd party web app. Ie. it will create a temporary deadbeef123@your-domain.com email address, use that to sign up to the 3rd party web app and keep the password secret from the user. Then, when the user returns to the site, your on-site server provides the auth details for each logon (or even better, logs in for the user and just sets the right cookies). For some sites, it will also make sure the user is a member of the right 'team', has access to the right shared documents, has their display name matching their name in the corp database, etc.
- deleted 3y ago
  [deleted]
- cj 3y ago
  Google Workspace can (sort of) do this. Although after googling, looks like they’re removing support. Basically it allowed IT Admins to “hide” the password from users logging into websites with traditional user/pass login flows. https://support.google.com/a/answer/9178974?hl=en https://support.google.com/a/answer/9178974?hl=en
api 3y ago
The SSO tax exists because it's historically been a roundabout way of segmenting the market into businesses vs. individuals and charging businesses more.
- mathiasn 3y ago
  Historically grown indeed ;-) It's fine to segment the market with a separate enterprise plan, I agree! I believe "keeping security hostage" by only allowing it for way too high prices (multiple of previous tier) is not right though.
pulvinar 3y ago
“The SSO tax” is the unofficial name for the practice of software vendors significantly upcharging their customers for Single Sign-On. (No, it's not Social Security Organization tax...)
hobs 3y ago
Laughs in enterprise pricing... 14 dollars a user a month? Try 250. Last time I talked with dbt on their enterprise plan for the Okta integration level they pitched us 3000 user/year with the clear acknowledgement that they just raised their prices 100% on their other tier and were about to do major price increases to their enterprise tier.
- Spooky23 3y ago
  If you work for a big company you need to play a little bad cop with companies like this. They usually only understand pain. Have the sales team fly in and kick them out, etc. Try to get the highest level people possible engaged, then get unreasonable. All of these folks will report some crazy deal opportunity and their chief sales guy will be at their throats back at home. You’ll get the concession you need. Best advice is to just avoid suppliers like this.
  - hobs 3y ago
    I just laughed in their face and said that their product wasn't good enough for me to not just spend one week implementing the parts I cared about, and I did.
    - reitanqild 3y ago
      To twist rhe knife, tell them you'll publish the relevant parts as open source as well.
  - satvikpendem 3y ago
    SaaS companies know this too. They'll charge a higher price than they're actually looking to get because they know that if you provide a concession at every step of the chain of the customer (biz dev, salesperson, VP, CTO, CEO, etc) in the buying journey, you are more likely to be bought over a company who had a lower overall price but didn't provide concessions. There are people in procurement who literally exist only to extract concessions from the seller.
    - 3y ago
ThePhysicist 3y ago
How does that solve the problem SSO typically solves? It seems you're trying to replace it by syncing users from different tools? That seems worse than SSO and is unlikely to be acceptable, as most security certifications require SSO as a best practice, manually syncing users from different tools won't cut it. Also, implementing SAML-based SSO from scratch isn't that difficult, I did it for our enterprise product and it's barely 500 lines of code. However, we had a nice role-based access management in our tool already, so adding SSO was just a matter of mapping SSO data to our internal role models. That part is usually what causes most effort, i.e. fine-grained access control for different parts of your application, SSO just provides the identity and group management layer that you can use as a basis for that. Apart from that, SSO is just a handy feature that non-Enterprise customers usually don't need while Enterprise customers do, so it's ideal for differentiating customers. That said an Enterprise edition contains much more than SSO in many cases, e.g. audit logging, containerized deployments, extensive support, etc.. That's what you pay for with an Enterprise offering, the SSO feature is just a small part of that.
- KyeRussell 3y ago
  This reads like a something written from the perspective of somebody involved in the creation of a SaaS product, but that has never actually been involved in buying one. To summarise your comment, my notes in parentheses: * This isn’t as good as SSO (I’m sure that OP knows that). * It doesn’t meet your requirements (I trust OP to know what their requirements are, and I myself have been in situations where this would be useful). * Implementing SSO from scratch isn’t hard. (That doesn’t mean bupkis to someone that wants to use SSO functionality of a SaaS product that they are subscribed to. Also, I’m highly skeptical of any SSO implementation that was ‘easy’ to write). * SSO’s usefulness is limited without proper access controls within the product (…yes?) * Only ‘enterprise’ customers want/need SSO. (This is a clear example of uninspired SaaS companies drooling over the white elephant ‘enterprise’ customer: someone with a bunch of money, that will pay for your value-add crap without batting an eyelid. I’ve worked in plenty of settings that I wouldn’t call “enterprise”, but that would’ve benefited highly from SSO. Unfortunately SSO is always locked behind AT BEST a significantly higher seat cost, but usually with a very high floor, and often behind a “contact sales” funnel. Replace “enterprise” with “business”, because that’s the reality. Then…look at your (probably B2B) SaaS product’s package differentiations, and tell me that you aren’t screwing people). * Enterprise plans usually come with way more than just SSO (Yes! half the point is that most people don’t want this stuff! It’s mostly shovelware to make it not look so egregious to pay so much more for SSO! You’re right! SSO is a small part of that! So why force people to buy the rest of the stuff if they don’t want it? Oh, that’s right, because you’re lining up behind the other SaaS vampires to prey on basically any organisation of more than 5 people that wants have their ducks in a row). It really just sounds like you’re trying to justify your employer’s crappy yet common sales tactics, and we’re just coming along for the ride.
throwawaaarrgh 3y ago
A fintech that can't pay $14 per user? How many employees do you have? "hours per quarter" but it's not worth the money? Where's the problem? Either you spend the money on a few hours of work for an intern or you fork over SSO money. SSO isn't a tax. You either need a single method to disable an account across all providers instantly and enforce password policies globally, or you don't. Do the risk vs reward math and then put the line item in your budget. Get a discount or use a reseller to avoid retail.
- masterjack 3y ago
  It'll be that price multiplied by how many SaaS tools you use, each of which will have some premium for their Enterprise plan supporting SSO, and typically they won't be transparent about what the price is or how to sign up for it, so you'll then have to go through the steps of negotiating an enterprise plan. Spending a few minutes to figure out their API sounds more fun
  - Spooky23 3y ago
    Why do you need all of these tools? It’s really a cost/time to market comparison between the SaaS and you just using SharePoint or managing some substitute. If you’re proposing to drop $80 u/m for Airtable, there better be a tight business case.
- varispeed 3y ago
  > A fintech that can't pay $14 per user? There costs add up quickly and it is prohibitive for a small business that is not profitable.
- ebiester 3y ago
  If it's one tool, it's not a problem. If it's every tool, it becomes a problem quickly. I had a tool that moved from 300/month to 2,000 a month just for SSO (for our needs.) Launchdarkly is just not usable due to the additional price for SSO. It's absolutely a tax if it's the only feature you need.
- m1keil 3y ago
distantsounds 3y ago
the "SSO tax" is literally the entire SSO product, a solution to a legitimate problem that businesses face and gladly shell out $$$ to not deal with. if your suggestion is to not pay said $$$ and instead roll your own solution, more power to you, but you're not "skipping" the SSO tax, you're simply passing it onto a different team to do the work of what SSO would provide you.
- Flipflip79 3y ago
  To be fair - if the SSO tax was just a single SKU for adding _just_ SSO to the platform and it was a reasonable like $2 - $4 a user addition, most people wouldn't care. When we refer to the SSO tax what we normally mean is that SSO is gated into the "Enterprise" category of a tool for some reason, implying that only Enterprises use SSO. The difference usually also includes other tools that the customer doesn't need (we only want SSO) and so the price difference is usually huge. It makes SSO unrealistic for non-enterprise size customers. IMO thats generally what people refer to when they say SSO tax. It isnt discounting that providing SSO requires work, its that its never decoupled from a huge platform upsell.
  - danenania 3y ago
    This reflects a trend of smaller and smaller companies using SSO, including startups that now use SSO right from the beginning because they know that certifications like SOC2 are on their roadmap and they want to get best practices in place early. In the past, it really was a 99% chance that customers wanting SSO were large companies, but that is changing. That said, I'd say the trend is overrepresented in places like HN. It's still mostly bigger companies that want SSO, which is why SAAS cos keep using it as a pricing differentiator.
kdeldycke 3y ago
For those wondering what the "SSO Tax" is, it refers to the excessive pricing practiced by SaaS providers to access the SSO feature on their product. A documented rant has made the rounds at https://sso.tax https://sso.tax , which lists all vendors and their pricing of SSO.
- deleted 3y ago
  [deleted]
- pwarner 3y ago
  I always thought this was insane, but now I wonder if "SSO Pricing"/tax is just the "real price" and the "Base pricing" is really the new free trial? Of course the SSO/real pricing is too high, and everyone negotiates it down, but the point is I suspect the "base pricing" is just a trial teaser that's probably not sustainable for many vendors in terms of margins. I'm just guessing here, maybe someone with some inside insight from one of these vendors can advise.
  - wongarsu 3y ago
    I'd rather consider it "SME pricing" vs "Enterprise pricing". Typically only companies above a certain size use SSO systems, and even larger ones require it for everything. Coincidentally bigger companies are also willing to pay more, so putting a high price on SSO enables SaaS to profit from those deep pockets without pricing themselves out of the market for smaller companies.
    - westurner 3y ago
      Schools, colleges, and universities typically have SSO but no budget or purchase authority.
      - wongarsu 3y ago
        Just slap an education discount on it and call it a day. There are plenty of reasons to do that anyway, you want students to get trained on your software and use it in their formative years as much as possible. Many go even further and just give the product away for free for educational institutions and individual students (Github, Jetbrains and Tableau come to mind as examples)
dbdoskey 3y ago
I think this is an amazing idea! I am struggling with a similar situation now. Anything that will allow to semi-automate this, and get a periodic report that compares this to where the Single Point of Truth for the account list would be amazing.
- PhLR 3y ago
  Great to see that we were not alone with the struggles! Let me know if you are up for a quick chat. Would love to learn more about your situation and how OpenOwl could help fix it. If you are up for it, my contact is in the bio
Flipflip79 3y ago
I think using the term "Skip the SSO Tax.." has done a little disservice to you, and I understand why you chose that term, but this is more "Skip the SCIM tax" I think? Regardless, I totally understand the use case and I can immediately put this to work for my team - we will likely contribute some recipes too. Thanks for sharing!
zebroc 3y ago
I like the fact that one could use this within a CI/CD pipeline for example. Well done, thanks for sharing!
vegardx 3y ago
I've done similar things in terraform in the past. But you eventually end up spending way too much time on it. If the tool isn't value enough for paying the premium, chances are there are other good alternatives, or we don't really need the tool to begin with. I just look at the individual plans as if they're student tickets for a conference. Now lets talk about SaaS providers that don't offer any other way than paying by credit card. Not even pre-paying with a wire transfer. If you've ever tried to source a company credit card in a huge organization you know how hard that can be. And no way in hell I'm going to put $10k/month for various services on my personal credit card and expense it every month. It sometimes feel like they don't even want to run a business.
goldenCeasar 3y ago
Hey mathiasn, I totally feel your pain! I work with the same kind of solution and know how everything can get way more complex than people think, I really liked the "recipes" idea for integrations. If you don't mind how about we have a chat?
- mathiasn 3y ago
  Sure, feel free to raise a GitHub issue, happy to discuss.
  - goldenCeasar 3y ago
    Sorry i wasn't clear, I mean talk about the company/career, I worked developing IAM for the last 4/5 years and I am looking around for new opportunities.
ensignavenger 3y ago
As one who self-hosts a number of Open Source applications for a small group of family and friends, I would love to have a simple SSO proxy solution. Many "open core" applications don't include SSO in their Open Source offerings, thus locking small non-commercial users like me out of SSO features for my small non-commercial group. I don't really need all of the auditing and compliance features this solution seems to currently offer- I just need a simple SSO proxy. If some one wants to build that, it could be a huge help for small non-commercial self-hosters like me.
- WirelessGigabit 3y ago
  I used Authelia and use OIDC wherever I can.
  - ensignavenger 3y ago
    Thanks, I haven't heard of Authelia before, looks like it may work well for my use. I see the OIDC provider support is considered beta, have you had good luck with it being stable and reliable?
    - WirelessGigabit 3y ago
      Yea have been running since it came out. What's important is that you follow the releases. Read the logs after you update. Something the configuration format changes. And there are some rough edges. But those are OIDC related. The actual authentication part is much older and stable. I've only had issues with a configuration NOT allowing me to sign in. Which I appreciate. I rather have a bug that blocks me vs one that allows me. And they're pretty responsive on discord.
- ycmimi 3y ago
  We have built one. Our service is free for up to 25 users. Just head over to https://datawiza.com https://datawiza.com to check it out. Hope it helps you and your friends & family enjoy your self-hosted apps even more!
- 3y ago
thallium205 3y ago
If you all think your vendor’s SSO price tags are bad, you should stay far away from what their healthcare HIPAA prices are.
OliverJones 3y ago
I have to say, I understood what this is really fast when I saw the README. It's really a great idea. I'dve been all over it before I :-) :-) retired. It's going to save growing companies a fortune, by helping cancel promptly unused money-sucking accounts across the SaaS multiverses. I just hope it's easy to use for superbusy founders, tech people now riding a success wave. Because those are often the people who do the account-cleanup job. If this tool is a pain in the *s to use, there's even more time down the hopper. It's almost impossible for people like us to teach ourselves to delegate by inflicting pain on ourselves. And saving big money is worth some pain, amirite? Been there. Done that. But HERE's an incentive to delegate: * grab the most talented devops person you know. * tell them about this open-source project * delegate to them this account-cleanup PITA * invite them to donate time to the open-source project and give them time to do so. * but they still have to do the actual cleanup regularly. * stand back and watch the growth of a REALLY USABLE open source money-leak-hunting project. Every single YCombinator portfolio company would benefit from this. You VC guys? Get some really smart interns to work on this too.
- PhLR 3y ago
  That's the spirit! Thanks for the kind words. Indeed, ease of use is incredibly important. After all this is a tool that needs to be used non-developer IT admins as well.
CSDude 3y ago
That's what we try to simplify at Resmo. We integrate with 80+ most popular tools a company might be using. Of course there are some we don't cover yet. Only 3 tools requires paid-tier for API access. Also, we list access Login with Google data from your workspace. We gave a central place for you to list the users and their permissions. https://resmo.com/saas-discovery https://resmo.com/saas-discovery Then you can do `SELECT * FROM users WHERE mail = 'mustafa@resmo.com'`
hnlmorg 3y ago
I really want to like this but the limitations described, requiring an admin account with 2FA disabled, makes this more risky than not using it at all. Until those limitations are resolved, if that’s even possible, this feels like an audit hack rather than a security solution.
- PhLR 3y ago
  In future versions it will be possible to do the same with, for example, your Google SSO sign-in and 2FA enabled. The reason for the limitation is that we simply wanted to get it out into the world and see if anybody is as excited about it as we are.
  - tracker1 3y ago
    For reference, the azure client, opens a browser for the login, which redirects to a dns address that equates to "localhost" on a port that will effectively get the final auth tokens to the local instance, which then persists and shuts down the service. Should be able to do very similar.
- numbsafari 3y ago
  Yeah, the current approach basically makes this entirely a non-starter for the target audience (eliminate a critical control for people for whom critical controls are a pain point). Uploading your 2FA tokens to a third party is also likely a non-starter, sorry.
  - mathiasn 3y ago
    You don't need to upload your 2FA tokens somewhere. Everything runs on your local machine. You can do whatever you want there.
- danielmarkbruce 3y ago
  Have you looked at Cerby?
LionTamer 3y ago
Love this idea - was considering trying to build something similar recently.
- PhLR 3y ago
  Thanks! Happy to chat if you want to share some of the ideas you had
- mathiasn 3y ago
  Did you also consider building it with Elixir and LiveView?
somegent 3y ago
I think your positioning is wrong. The problem this solves is auditing user accounts in SaaS applications. That is a great problem to be solving, and you can position yourself on that! Why talk about 'SSO Tax' when this has nothing to do with SSO? There is at least one other 'open' library for solving this problem (https://github.com/ConductorOne/baton https://github.com/ConductorOne/baton). However, I like how you're scraping web data for apps that don't have APIs. I've been waiting for someone to do that. That said, I want it built into other tooling I have purchased, so I don't have to implement myself.
- PhLR 3y ago
  'Auditing user accounts in SaaS applications' is a pretty good summary of what the current version is about. The 'SSO-Tax' has become a synonym for the extra charges of SaaS vendors in which they usually bundle 3rd party SSO, SCIM and SAML. What other tooling would you want it to integrate with?
- danielmarkbruce 3y ago
  Cerby does this. I'm not them, but I know one of the guys there.
shellcromancer 3y ago
Shameless self-plug for an alternative tax that affects operational security and reliability teams: https://audit-logs.tax https://audit-logs.tax Understanding how your breach impacts me, or detecting how the abuse of your tools are used to impact our organizations shouldn't cost additional money or be gated to only enterprise contracts. Happy to take PRs for other vendors logs being added: https://github.com/shellcromancer/audit-log-wall-of-shame https://github.com/shellcromancer/audit-log-wall-of-shame
westurner 3y ago
https://github.com/doncicuto/glim https://github.com/doncicuto/glim : > Glim is a simple identity access management system that speaks some LDAP and has a REST API to manage users and groups "Proxy LDAP to limit scope of access #60" https://github.com/doncicuto/glim/issues/60 https://github.com/doncicuto/glim/issues/60
Nezteb 3y ago
As a dev who primarily uses Elixir, I was excited to see that you built OpenOwl with it! Out of curiosity, what made you choose Elixir? I wanted to use Elixir to build my PDF scraper (https://github.com/Nezteb/scrape-pdf https://github.com/Nezteb/scrape-pdf) but didn't want to spend too much time figuring out how to use Playwright from Elixir, so I went with Node. I'll have to borrow some of your methods!
- mathiasn 3y ago
  Oh yeah, Elixir is just amazing <3. We use it for our commercial platform accessowl.io. Parts of OpenOwl are originated from there. It was the fastest way to push OpenOwl out. Moreover doing it like this allows us to use OpenOwl as library there. But yeah I was thinking longer about it as Playwright is pretty good for scraping/RPA and works best with Node. One (expected) limitation is that we cannot easily open a browser window to let the user enter a OTP or solve a captcha as we encapsulated everything into Docker. Not sure how we can solve it yet...
cratermoon 3y ago
As someone who has worked with SAML and other authn/authz technologies, I can only say that the reason for the SSO tax is because that stuff is unreasonably complicated and hard to make work. From things like Microsoft's half-baked proprietary version of SAML to the typical company's crappy in-house login system that was thrown together on top of a system built with security as an afterthought, doing SSO is never simple. Security as an afterthought is always way more difficult than if someone had thought about user roles and permission from the beginning. On top of that, even little companies expect to have things like "well, the execs never really log in, so we need to be able to delegate permissions, but only for things the execs want them to do. We can't give them permissions to sign off on bonuses for themselves". Knowing what I know, I don't really begrudge any SSO provider their premium pricing.
alex7734 3y ago
Why don't companies instead of doing this simply say "if you have more than X employees you can only pick the enterprise tier"? Is it illegal or something? I mean you could of course lie when signing up but if a company is risk averse enough to use SSO it's probably risk averse enough to not breach contracts.
- esafak 3y ago
  Because it's hard to formulate a subjective choice of X, for starters. Can anyone think of any other reasonable product-agnostic criteria other than SSO?

220 points by mathiasn 3y ago

dboreham 3y ago

I recommend some editing of the readme to clarify the tool's purpose. Initially I thought it might be an AI-generated spoof project since the description made no sense. I think the tool is for the following scenario: you are a manager in an organization where some set of your employees are using some specific SaaS (see list of currently supported SaaS'es below). You would like to see a list of the user accounts for your employees within your company's "domain" in said SaaS, along with some account metadata. This tool extracts that info using the SaaS domain management API.

mathiasn 3y ago
Oh thanks a lot. I updated the repo description. You're right with what you think though :-)

cheeseblubber 3y ago

The SSO part is a bit confusing since it sounds like the product is letting you download account and permissions data based on your own api key. It might be helpful if you clarify how you can help with the SSO portion of things.

cj 3y ago
In a similar vein, I’m confused by the messaging: “SSO is expensive” problem, the “access user data” problem, “centrally manage permissions” problem, and “automatic account provisioning/deprovisioning” problem. The marketing seems to jumble those 4 problems into 1 problem when (at least to me) they’re 4 very distinct problems to solve. That leaves me wondering which of those problems are you truly solving? All 4 or just a subset?
- mathiasn 3y ago
  Fantastic feedback. Indeed these are distinctive problems. For instance, "SSO is expensive" seems to be the root cause for the "centrally manage permissions" and "automatic account provisioning/deprovisioning" problems. At least when we're not talking about enterprises. OpenOwl tries to give transparency over the user permission data in your SaaS tools - independent whether you have SCIM APIs or not. It's read-only though. No automatic account provisioning here. However, as some of these problems are very close to each other, it could make sense to solve them together. But that's not the intent for OpenOwl.
mathiasn 3y ago
That's a good point. Indeed there is a technical focus on login flows at the moment as this seems like the hardest problem to solve. Adding API key flows makes definitely sense though!

lozenge 3y ago

This is cool, in that it might encourage SaaS providers to reduce the SSO tax. Discouraging security affects all of us whose data is held by other companies (ie everybody). I'm sure you'll get comments that you're being penny wise pound foolish and wasting your time with these hacks. That entirely depends on where your company is located. As it supports so few services, putting the list up top in the README would be a good idea, and a quick explanation of what programming languages/methods can be used to add more services. The chances another organisation has picked the same 7 services as you is pretty low.

mathiasn 3y ago
I really hope that companies stop putting SSO/SCIM into a separate plan but allow using it in lower plans. Thanks for the idea. That makes sense. We hope that more recipes can be added soon so that there is more coverage for everyone.

londons_explore 3y ago

It'd like some kind of chrome extension that will 'sso-ize' any 3rd party web app. Ie. it will create a temporary deadbeef123@your-domain.com email address, use that to sign up to the 3rd party web app and keep the password secret from the user. Then, when the user returns to the site, your on-site server provides the auth details for each logon (or even better, logs in for the user and just sets the right cookies). For some sites, it will also make sure the user is a member of the right 'team', has access to the right shared documents, has their display name matching their name in the corp database, etc.

deleted 3y ago
[deleted]
cj 3y ago
Google Workspace can (sort of) do this. Although after googling, looks like they’re removing support. Basically it allowed IT Admins to “hide” the password from users logging into websites with traditional user/pass login flows. https://support.google.com/a/answer/9178974?hl=en https://support.google.com/a/answer/9178974?hl=en

api 3y ago

The SSO tax exists because it's historically been a roundabout way of segmenting the market into businesses vs. individuals and charging businesses more.

mathiasn 3y ago
Historically grown indeed ;-) It's fine to segment the market with a separate enterprise plan, I agree! I believe "keeping security hostage" by only allowing it for way too high prices (multiple of previous tier) is not right though.

pulvinar 3y ago

“The SSO tax” is the unofficial name for the practice of software vendors significantly upcharging their customers for Single Sign-On. (No, it's not Social Security Organization tax...)

hobs 3y ago

Laughs in enterprise pricing... 14 dollars a user a month? Try 250. Last time I talked with dbt on their enterprise plan for the Okta integration level they pitched us 3000 user/year with the clear acknowledgement that they just raised their prices 100% on their other tier and were about to do major price increases to their enterprise tier.

Spooky23 3y ago
If you work for a big company you need to play a little bad cop with companies like this. They usually only understand pain. Have the sales team fly in and kick them out, etc. Try to get the highest level people possible engaged, then get unreasonable. All of these folks will report some crazy deal opportunity and their chief sales guy will be at their throats back at home. You’ll get the concession you need. Best advice is to just avoid suppliers like this.
- hobs 3y ago
  I just laughed in their face and said that their product wasn't good enough for me to not just spend one week implementing the parts I cared about, and I did.
  - reitanqild 3y ago
    To twist rhe knife, tell them you'll publish the relevant parts as open source as well.
- satvikpendem 3y ago
  SaaS companies know this too. They'll charge a higher price than they're actually looking to get because they know that if you provide a concession at every step of the chain of the customer (biz dev, salesperson, VP, CTO, CEO, etc) in the buying journey, you are more likely to be bought over a company who had a lower overall price but didn't provide concessions. There are people in procurement who literally exist only to extract concessions from the seller.
  - 3y ago

ThePhysicist 3y ago

How does that solve the problem SSO typically solves? It seems you're trying to replace it by syncing users from different tools? That seems worse than SSO and is unlikely to be acceptable, as most security certifications require SSO as a best practice, manually syncing users from different tools won't cut it. Also, implementing SAML-based SSO from scratch isn't that difficult, I did it for our enterprise product and it's barely 500 lines of code. However, we had a nice role-based access management in our tool already, so adding SSO was just a matter of mapping SSO data to our internal role models. That part is usually what causes most effort, i.e. fine-grained access control for different parts of your application, SSO just provides the identity and group management layer that you can use as a basis for that. Apart from that, SSO is just a handy feature that non-Enterprise customers usually don't need while Enterprise customers do, so it's ideal for differentiating customers. That said an Enterprise edition contains much more than SSO in many cases, e.g. audit logging, containerized deployments, extensive support, etc.. That's what you pay for with an Enterprise offering, the SSO feature is just a small part of that.

KyeRussell 3y ago
This reads like a something written from the perspective of somebody involved in the creation of a SaaS product, but that has never actually been involved in buying one. To summarise your comment, my notes in parentheses: * This isn’t as good as SSO (I’m sure that OP knows that). * It doesn’t meet your requirements (I trust OP to know what their requirements are, and I myself have been in situations where this would be useful). * Implementing SSO from scratch isn’t hard. (That doesn’t mean bupkis to someone that wants to use SSO functionality of a SaaS product that they are subscribed to. Also, I’m highly skeptical of any SSO implementation that was ‘easy’ to write). * SSO’s usefulness is limited without proper access controls within the product (…yes?) * Only ‘enterprise’ customers want/need SSO. (This is a clear example of uninspired SaaS companies drooling over the white elephant ‘enterprise’ customer: someone with a bunch of money, that will pay for your value-add crap without batting an eyelid. I’ve worked in plenty of settings that I wouldn’t call “enterprise”, but that would’ve benefited highly from SSO. Unfortunately SSO is always locked behind AT BEST a significantly higher seat cost, but usually with a very high floor, and often behind a “contact sales” funnel. Replace “enterprise” with “business”, because that’s the reality. Then…look at your (probably B2B) SaaS product’s package differentiations, and tell me that you aren’t screwing people). * Enterprise plans usually come with way more than just SSO (Yes! half the point is that most people don’t want this stuff! It’s mostly shovelware to make it not look so egregious to pay so much more for SSO! You’re right! SSO is a small part of that! So why force people to buy the rest of the stuff if they don’t want it? Oh, that’s right, because you’re lining up behind the other SaaS vampires to prey on basically any organisation of more than 5 people that wants have their ducks in a row). It really just sounds like you’re trying to justify your employer’s crappy yet common sales tactics, and we’re just coming along for the ride.

throwawaaarrgh 3y ago

A fintech that can't pay $14 per user? How many employees do you have? "hours per quarter" but it's not worth the money? Where's the problem? Either you spend the money on a few hours of work for an intern or you fork over SSO money. SSO isn't a tax. You either need a single method to disable an account across all providers instantly and enforce password policies globally, or you don't. Do the risk vs reward math and then put the line item in your budget. Get a discount or use a reseller to avoid retail.

masterjack 3y ago
It'll be that price multiplied by how many SaaS tools you use, each of which will have some premium for their Enterprise plan supporting SSO, and typically they won't be transparent about what the price is or how to sign up for it, so you'll then have to go through the steps of negotiating an enterprise plan. Spending a few minutes to figure out their API sounds more fun
- Spooky23 3y ago
  Why do you need all of these tools? It’s really a cost/time to market comparison between the SaaS and you just using SharePoint or managing some substitute. If you’re proposing to drop $80 u/m for Airtable, there better be a tight business case.
varispeed 3y ago
> A fintech that can't pay $14 per user? There costs add up quickly and it is prohibitive for a small business that is not profitable.
ebiester 3y ago
If it's one tool, it's not a problem. If it's every tool, it becomes a problem quickly. I had a tool that moved from 300/month to 2,000 a month just for SSO (for our needs.) Launchdarkly is just not usable due to the additional price for SSO. It's absolutely a tax if it's the only feature you need.
m1keil 3y ago

distantsounds 3y ago

the "SSO tax" is literally the entire SSO product, a solution to a legitimate problem that businesses face and gladly shell out $$$ to not deal with. if your suggestion is to not pay said $$$ and instead roll your own solution, more power to you, but you're not "skipping" the SSO tax, you're simply passing it onto a different team to do the work of what SSO would provide you.

Flipflip79 3y ago
To be fair - if the SSO tax was just a single SKU for adding _just_ SSO to the platform and it was a reasonable like $2 - $4 a user addition, most people wouldn't care. When we refer to the SSO tax what we normally mean is that SSO is gated into the "Enterprise" category of a tool for some reason, implying that only Enterprises use SSO. The difference usually also includes other tools that the customer doesn't need (we only want SSO) and so the price difference is usually huge. It makes SSO unrealistic for non-enterprise size customers. IMO thats generally what people refer to when they say SSO tax. It isnt discounting that providing SSO requires work, its that its never decoupled from a huge platform upsell.
- danenania 3y ago
  This reflects a trend of smaller and smaller companies using SSO, including startups that now use SSO right from the beginning because they know that certifications like SOC2 are on their roadmap and they want to get best practices in place early. In the past, it really was a 99% chance that customers wanting SSO were large companies, but that is changing. That said, I'd say the trend is overrepresented in places like HN. It's still mostly bigger companies that want SSO, which is why SAAS cos keep using it as a pricing differentiator.

kdeldycke 3y ago

For those wondering what the "SSO Tax" is, it refers to the excessive pricing practiced by SaaS providers to access the SSO feature on their product. A documented rant has made the rounds at https://sso.tax https://sso.tax , which lists all vendors and their pricing of SSO.

deleted 3y ago
[deleted]
pwarner 3y ago
I always thought this was insane, but now I wonder if "SSO Pricing"/tax is just the "real price" and the "Base pricing" is really the new free trial? Of course the SSO/real pricing is too high, and everyone negotiates it down, but the point is I suspect the "base pricing" is just a trial teaser that's probably not sustainable for many vendors in terms of margins. I'm just guessing here, maybe someone with some inside insight from one of these vendors can advise.
- wongarsu 3y ago
  I'd rather consider it "SME pricing" vs "Enterprise pricing". Typically only companies above a certain size use SSO systems, and even larger ones require it for everything. Coincidentally bigger companies are also willing to pay more, so putting a high price on SSO enables SaaS to profit from those deep pockets without pricing themselves out of the market for smaller companies.
  - westurner 3y ago
    Schools, colleges, and universities typically have SSO but no budget or purchase authority.
    - wongarsu 3y ago
      Just slap an education discount on it and call it a day. There are plenty of reasons to do that anyway, you want students to get trained on your software and use it in their formative years as much as possible. Many go even further and just give the product away for free for educational institutions and individual students (Github, Jetbrains and Tableau come to mind as examples)

dbdoskey 3y ago

I think this is an amazing idea! I am struggling with a similar situation now. Anything that will allow to semi-automate this, and get a periodic report that compares this to where the Single Point of Truth for the account list would be amazing.

PhLR 3y ago
Great to see that we were not alone with the struggles! Let me know if you are up for a quick chat. Would love to learn more about your situation and how OpenOwl could help fix it. If you are up for it, my contact is in the bio

Flipflip79 3y ago

I think using the term "Skip the SSO Tax.." has done a little disservice to you, and I understand why you chose that term, but this is more "Skip the SCIM tax" I think? Regardless, I totally understand the use case and I can immediately put this to work for my team - we will likely contribute some recipes too. Thanks for sharing!

zebroc 3y ago

I like the fact that one could use this within a CI/CD pipeline for example. Well done, thanks for sharing!

vegardx 3y ago

I've done similar things in terraform in the past. But you eventually end up spending way too much time on it. If the tool isn't value enough for paying the premium, chances are there are other good alternatives, or we don't really need the tool to begin with. I just look at the individual plans as if they're student tickets for a conference. Now lets talk about SaaS providers that don't offer any other way than paying by credit card. Not even pre-paying with a wire transfer. If you've ever tried to source a company credit card in a huge organization you know how hard that can be. And no way in hell I'm going to put $10k/month for various services on my personal credit card and expense it every month. It sometimes feel like they don't even want to run a business.

goldenCeasar 3y ago

Hey mathiasn, I totally feel your pain! I work with the same kind of solution and know how everything can get way more complex than people think, I really liked the "recipes" idea for integrations. If you don't mind how about we have a chat?

mathiasn 3y ago
Sure, feel free to raise a GitHub issue, happy to discuss.
- goldenCeasar 3y ago
  Sorry i wasn't clear, I mean talk about the company/career, I worked developing IAM for the last 4/5 years and I am looking around for new opportunities.

ensignavenger 3y ago

As one who self-hosts a number of Open Source applications for a small group of family and friends, I would love to have a simple SSO proxy solution. Many "open core" applications don't include SSO in their Open Source offerings, thus locking small non-commercial users like me out of SSO features for my small non-commercial group. I don't really need all of the auditing and compliance features this solution seems to currently offer- I just need a simple SSO proxy. If some one wants to build that, it could be a huge help for small non-commercial self-hosters like me.

WirelessGigabit 3y ago
I used Authelia and use OIDC wherever I can.
- ensignavenger 3y ago
  Thanks, I haven't heard of Authelia before, looks like it may work well for my use. I see the OIDC provider support is considered beta, have you had good luck with it being stable and reliable?
  - WirelessGigabit 3y ago
    Yea have been running since it came out. What's important is that you follow the releases. Read the logs after you update. Something the configuration format changes. And there are some rough edges. But those are OIDC related. The actual authentication part is much older and stable. I've only had issues with a configuration NOT allowing me to sign in. Which I appreciate. I rather have a bug that blocks me vs one that allows me. And they're pretty responsive on discord.
ycmimi 3y ago
We have built one. Our service is free for up to 25 users. Just head over to https://datawiza.com https://datawiza.com to check it out. Hope it helps you and your friends & family enjoy your self-hosted apps even more!
3y ago

thallium205 3y ago

If you all think your vendor’s SSO price tags are bad, you should stay far away from what their healthcare HIPAA prices are.

OliverJones 3y ago

I have to say, I understood what this is really fast when I saw the README. It's really a great idea. I'dve been all over it before I :-) :-) retired. It's going to save growing companies a fortune, by helping cancel promptly unused money-sucking accounts across the SaaS multiverses. I just hope it's easy to use for superbusy founders, tech people now riding a success wave. Because those are often the people who do the account-cleanup job. If this tool is a pain in the *s to use, there's even more time down the hopper. It's almost impossible for people like us to teach ourselves to delegate by inflicting pain on ourselves. And saving big money is worth some pain, amirite? Been there. Done that. But HERE's an incentive to delegate: * grab the most talented devops person you know. * tell them about this open-source project * delegate to them this account-cleanup PITA * invite them to donate time to the open-source project and give them time to do so. * but they still have to do the actual cleanup regularly. * stand back and watch the growth of a REALLY USABLE open source money-leak-hunting project. Every single YCombinator portfolio company would benefit from this. You VC guys? Get some really smart interns to work on this too.

PhLR 3y ago
That's the spirit! Thanks for the kind words. Indeed, ease of use is incredibly important. After all this is a tool that needs to be used non-developer IT admins as well.

CSDude 3y ago

That's what we try to simplify at Resmo. We integrate with 80+ most popular tools a company might be using. Of course there are some we don't cover yet. Only 3 tools requires paid-tier for API access. Also, we list access Login with Google data from your workspace. We gave a central place for you to list the users and their permissions. https://resmo.com/saas-discovery https://resmo.com/saas-discovery Then you can do `SELECT * FROM users WHERE mail = 'mustafa@resmo.com'`

hnlmorg 3y ago

I really want to like this but the limitations described, requiring an admin account with 2FA disabled, makes this more risky than not using it at all. Until those limitations are resolved, if that’s even possible, this feels like an audit hack rather than a security solution.

PhLR 3y ago
In future versions it will be possible to do the same with, for example, your Google SSO sign-in and 2FA enabled. The reason for the limitation is that we simply wanted to get it out into the world and see if anybody is as excited about it as we are.
- tracker1 3y ago
  For reference, the azure client, opens a browser for the login, which redirects to a dns address that equates to "localhost" on a port that will effectively get the final auth tokens to the local instance, which then persists and shuts down the service. Should be able to do very similar.
numbsafari 3y ago
Yeah, the current approach basically makes this entirely a non-starter for the target audience (eliminate a critical control for people for whom critical controls are a pain point). Uploading your 2FA tokens to a third party is also likely a non-starter, sorry.
- mathiasn 3y ago
  You don't need to upload your 2FA tokens somewhere. Everything runs on your local machine. You can do whatever you want there.
danielmarkbruce 3y ago
Have you looked at Cerby?

LionTamer 3y ago

Love this idea - was considering trying to build something similar recently.

PhLR 3y ago
Thanks! Happy to chat if you want to share some of the ideas you had
mathiasn 3y ago
Did you also consider building it with Elixir and LiveView?

somegent 3y ago

I think your positioning is wrong. The problem this solves is auditing user accounts in SaaS applications. That is a great problem to be solving, and you can position yourself on that! Why talk about 'SSO Tax' when this has nothing to do with SSO? There is at least one other 'open' library for solving this problem (https://github.com/ConductorOne/baton https://github.com/ConductorOne/baton). However, I like how you're scraping web data for apps that don't have APIs. I've been waiting for someone to do that. That said, I want it built into other tooling I have purchased, so I don't have to implement myself.

PhLR 3y ago
'Auditing user accounts in SaaS applications' is a pretty good summary of what the current version is about. The 'SSO-Tax' has become a synonym for the extra charges of SaaS vendors in which they usually bundle 3rd party SSO, SCIM and SAML. What other tooling would you want it to integrate with?
danielmarkbruce 3y ago
Cerby does this. I'm not them, but I know one of the guys there.

shellcromancer 3y ago

Shameless self-plug for an alternative tax that affects operational security and reliability teams: https://audit-logs.tax https://audit-logs.tax Understanding how your breach impacts me, or detecting how the abuse of your tools are used to impact our organizations shouldn't cost additional money or be gated to only enterprise contracts. Happy to take PRs for other vendors logs being added: https://github.com/shellcromancer/audit-log-wall-of-shame https://github.com/shellcromancer/audit-log-wall-of-shame

westurner 3y ago

https://github.com/doncicuto/glim https://github.com/doncicuto/glim : > Glim is a simple identity access management system that speaks some LDAP and has a REST API to manage users and groups "Proxy LDAP to limit scope of access #60" https://github.com/doncicuto/glim/issues/60 https://github.com/doncicuto/glim/issues/60

Nezteb 3y ago

As a dev who primarily uses Elixir, I was excited to see that you built OpenOwl with it! Out of curiosity, what made you choose Elixir? I wanted to use Elixir to build my PDF scraper (https://github.com/Nezteb/scrape-pdf https://github.com/Nezteb/scrape-pdf) but didn't want to spend too much time figuring out how to use Playwright from Elixir, so I went with Node. I'll have to borrow some of your methods!

mathiasn 3y ago
Oh yeah, Elixir is just amazing <3. We use it for our commercial platform accessowl.io. Parts of OpenOwl are originated from there. It was the fastest way to push OpenOwl out. Moreover doing it like this allows us to use OpenOwl as library there. But yeah I was thinking longer about it as Playwright is pretty good for scraping/RPA and works best with Node. One (expected) limitation is that we cannot easily open a browser window to let the user enter a OTP or solve a captcha as we encapsulated everything into Docker. Not sure how we can solve it yet...

cratermoon 3y ago

As someone who has worked with SAML and other authn/authz technologies, I can only say that the reason for the SSO tax is because that stuff is unreasonably complicated and hard to make work. From things like Microsoft's half-baked proprietary version of SAML to the typical company's crappy in-house login system that was thrown together on top of a system built with security as an afterthought, doing SSO is never simple. Security as an afterthought is always way more difficult than if someone had thought about user roles and permission from the beginning. On top of that, even little companies expect to have things like "well, the execs never really log in, so we need to be able to delegate permissions, but only for things the execs want them to do. We can't give them permissions to sign off on bonuses for themselves". Knowing what I know, I don't really begrudge any SSO provider their premium pricing.

alex7734 3y ago

Why don't companies instead of doing this simply say "if you have more than X employees you can only pick the enterprise tier"? Is it illegal or something? I mean you could of course lie when signing up but if a company is risk averse enough to use SSO it's probably risk averse enough to not breach contracts.

esafak 3y ago
Because it's hard to formulate a subjective choice of X, for starters. Can anyone think of any other reasonable product-agnostic criteria other than SSO?