5 ms·

OR, you can just run your own SAML and OAuth SSO (Shibboleth is one example) instead of delegating one of the most critical aspects of A3E over to an external v

OR, you can just run your own SAML and OAuth SSO (Shibboleth is one example) instead of delegating one of the most critical aspects of A3E over to an external vendor.

FearNotDaniel 4y ago
A3E? Nothing on the first page of Google results for the term seems to have any connection with the context, not even if keywords meaning/web development/web security are added to the search. Would you care to expand the abbreviation for those unfamiliar with it?
- gabrielsroka 4y ago
  I think A3 is authentication, authorization, accounting. I'm not sure what the E is.
mooreds 4y ago
It's a tradeoff, right? FusionAuth (my employer) has a self-hosted and a SaaS option; we let customers choose what works best for them, and have a roughly even split of paying customers between the two options. (Far more non-paying users self-host because that is free with our community edition.) However, running a high availability auth service isn't in the core skills of every software team, and therefore folks want to outsource it. That way the teams can focus on building and running the software that is core to their business. On the other hand, some folks have teams and processes to run a service like auth at a high level of reliability. In this case, using OSS options like Shibboleth and Keycloak makes a lot of sense. At FusionAuth, we see customers migrate from those systems because they want something more modern with a team releasing new features (with their feedback). OSS has some fiddly parts, and knowing who to ask for support can be tough (though there are contractors out there who can help). It's not a trivial choice. As mentioned in the article there's a fair amount of lock-in. The lock-in is both technical (if you build features on top of non-standard parts of an auth server) and organizational (once you have a working auth system, you aren't going to get a ton of new features if you move), which is why Okta has negative churn (as reported in their earnings). But if you build to OIDC and put facades around the provider, you should be able to migrate (make sure you can get your password hashes as well as other data). tl;dr: it depends :)
- gabrielsroka 4y ago
  > Okta has negative churn (as reported in their earnings) Churn means they lost customers. So negative churn means that they gained customers? I looked in the last four quarters and it said they gained customers each quarter. Do you have a source for your claim? Disclosure: I used to work for Okta, but I don't anymore.
  - mooreds 4y ago
    Negative churn means that they gained more $$ from existing customers than they lost. https://finmark.com/glossary/negative-churn/ https://finmark.com/glossary/negative-churn/ See https://investor.okta.com/static-files/8a461359-83f8-4332-9f41-eb7ee8c65c3b https://investor.okta.com/static-files/8a461359-83f8-4332-9f... , the "Dollar-based net retention rate for the trailing 12 months ended" numbers.
    - gabrielsroka 4y ago
      According to the article you posted, negative churn is a good thing. For the last 9 years: 2015: 129% 2016: 120% 2017: 123% 2018: 121% 2019: 120% 2020: 119% 2021: 121% 2022: 124% 2023: 120%
      - mooreds 3y ago
        Oh yes, it's definitely a good thing for the company. And presumably for the purchaser, otherwise why would they do it? It is evidence that auth is sticky.

OR, you can just run your own SAML and OAuth SSO (Shibboleth is one example) instead of delegating one of the most critical aspects of A3E over to an external vendor.

FearNotDaniel 4y ago

A3E? Nothing on the first page of Google results for the term seems to have any connection with the context, not even if keywords meaning/web development/web security are added to the search. Would you care to expand the abbreviation for those unfamiliar with it?

gabrielsroka 4y ago
I think A3 is authentication, authorization, accounting. I'm not sure what the E is.

mooreds 4y ago

It's a tradeoff, right? FusionAuth (my employer) has a self-hosted and a SaaS option; we let customers choose what works best for them, and have a roughly even split of paying customers between the two options. (Far more non-paying users self-host because that is free with our community edition.) However, running a high availability auth service isn't in the core skills of every software team, and therefore folks want to outsource it. That way the teams can focus on building and running the software that is core to their business. On the other hand, some folks have teams and processes to run a service like auth at a high level of reliability. In this case, using OSS options like Shibboleth and Keycloak makes a lot of sense. At FusionAuth, we see customers migrate from those systems because they want something more modern with a team releasing new features (with their feedback). OSS has some fiddly parts, and knowing who to ask for support can be tough (though there are contractors out there who can help). It's not a trivial choice. As mentioned in the article there's a fair amount of lock-in. The lock-in is both technical (if you build features on top of non-standard parts of an auth server) and organizational (once you have a working auth system, you aren't going to get a ton of new features if you move), which is why Okta has negative churn (as reported in their earnings). But if you build to OIDC and put facades around the provider, you should be able to migrate (make sure you can get your password hashes as well as other data). tl;dr: it depends :)

gabrielsroka 4y ago
> Okta has negative churn (as reported in their earnings) Churn means they lost customers. So negative churn means that they gained customers? I looked in the last four quarters and it said they gained customers each quarter. Do you have a source for your claim? Disclosure: I used to work for Okta, but I don't anymore.
- mooreds 4y ago
  Negative churn means that they gained more $$ from existing customers than they lost. https://finmark.com/glossary/negative-churn/ https://finmark.com/glossary/negative-churn/ See https://investor.okta.com/static-files/8a461359-83f8-4332-9f41-eb7ee8c65c3b https://investor.okta.com/static-files/8a461359-83f8-4332-9f... , the "Dollar-based net retention rate for the trailing 12 months ended" numbers.
  - gabrielsroka 4y ago
    According to the article you posted, negative churn is a good thing. For the last 9 years: 2015: 129% 2016: 120% 2017: 123% 2018: 121% 2019: 120% 2020: 119% 2021: 121% 2022: 124% 2023: 120%
    - mooreds 3y ago
      Oh yes, it's definitely a good thing for the company. And presumably for the purchaser, otherwise why would they do it? It is evidence that auth is sticky.