6 ms·

AWS Cognito

212 points by nateb2022 3y ago

awestroke 3y ago
The fact that it's written in java made me lose interest. I just can't afford hiring a jvm specialist to tune jvm deployments
- rishabhpoddar 3y ago
  We provide a docker container which manages running the SuperTokens core (the java part) for you. You can easily run several of these behind a load balancer and scale to millions of MAU. We have several users who have done this with no java knowledge whatsoever.
  - chayesfss 3y ago
    [dead]
- Eldt 3y ago
  Why would you need to tune the JVM, and why would you need a specialist for that?
  - booi 3y ago
    Well you really should manage the amount of memory available to Java.. ie the -Xms and -Xmx values at high scale. That generally all that’s needed 95% of the time. Maybe the commenter is not comfortable with this?
    - re-thc 3y ago
      It doesn't sound like a specialist task if it happens 95% of the time. The commenter just wanted to bash Java for no reason.
aweheel 3y ago
How does this differentiate from other open source identity solutions like KeyCloak or Ory? I wish there was more collaboration in this space, especially singe we’re talking security and these projects need pen testing, bug bounties, and more infrastructure to be considered „production grade“.
- wvv 3y ago
  There is a comparison chart available: https://supertokens.com/pricing#comparison-chart https://supertokens.com/pricing#comparison-chart
  - aweheel 3y ago
    Putting user satisfaction in the chart and not backing it with sources (I know at least a handful of companies who are very satisfied with e.g. KeyCloak) does not instill lots of confidence in the product differentiation. And what does customizability mean? KeyCloak has a rich Plugin system. Other than that it seems to be quite equal, if you discount the more difficult things in Auth like providing standardized APIs, OAuth2 APIs and SCIM.
    - advaitruia 3y ago
      Yes, its a very subjective point. We've mentioned the source (if you hover) and it is based on our internal user research and conversations with users of these products. By no means is it perfect and there are many many satisfied customers of each of the other products. Your point is taken though and maybe we will edit that point out or try to add further nuance. I do believe however that broadly speaking, that reviews of keycloak lean towards it being relatively harder to use and maintain than Firebase. Arguably the reviews of Cognito are more mixed than "Low"
    - robertlagrant 3y ago
      It's tricky to make these marketing charts objective. It would be good to have a real comparison somewhere.
  - 3y ago
netzego 3y ago
"[...] it is forbidden to copy, merge, publish, distribute, sublicense, and/or sell the Software." [1] "Open source is source code that is made freely available for possible modification and redistribution." [2] [1] https://github.com/supertokens/supertokens-core/blob/master/ee/LICENSE.md https://github.com/supertokens/supertokens-core/blob/master/... [2] https://en.wikipedia.org/wiki/Open_source https://en.wikipedia.org/wiki/Open_source
- jorams 3y ago
  That is the license for the contents of the "ee" directory. The top-level LICENSE is Apache 2.0. I don't know to what extent this code is integrated into the rest, but it's a valid way to develop open-core software.
  - Lacerda69 3y ago
    What features of supertokens are not open source and part of that "enterprise" directory?
    - pmontra 3y ago
      I see a feature flag and a license check class. https://github.com/supertokens/supertokens-core/tree/master/ee/src/main/java/io/supertokens/ee https://github.com/supertokens/supertokens-core/tree/master/...
    - hobofan 3y ago
      As of right now, nothing. The only thing that is in there is a license key checker and basic infrastructure for feature flags.
  - netzego 3y ago
    "The concept of open-core software has proven to be controversial, as many developers do not consider the business model to be true open-source software. Despite this, open-core models are used by many [...] software companies." [1] [1] https://en.wikipedia.org/wiki/Open-core_model https://en.wikipedia.org/wiki/Open-core_model I rather go with this definition. Opensource != opencore. Despite this, you're right, that is the license for `ee` folder.
ahachete 3y ago
This is an Open Core product. The open source part of it seems to be quite limited (see https://supertokens.com/pricing https://supertokens.com/pricing) and therefore I have a hard time believing this version can be "an alternative to [...]". Actually, the main motto of the frontpage is "Open Source User Authentication", which I also think is a bit of a mischaracterization of the software, since key features I'd look for on an authentication software are not open source. I love that this is a Java-based project and the goals and ideas behind it; but I think the so prominent use of the terms "open source" is misleading and I recommend demoting them or using alternative terms to reflect a more precise reality.
- advaitruia 3y ago
  Many of the core features are open source. Eg all the authentication methods - email password, passwordless, social etc are all in the open source product. You can also use the open source components to implement email based or SMS based 2FA. RBAC, session management and user management dashboard are open source too. Its several years of an engineering team's work that is all open source. Our philosophy is to keep features that are broadly required by developers and small companies in the open source version. Things that large companies require, will be source available. We have several enterprises (more than $100M raised or several hundred employees) that are using SuperTokens at the scale of millions of monthly active users - all using the open source product. We think the open source product is a sufficient alternative (for a large enough population). Are there any other features you feel should be in the open source version? Happy to hear any feedback and improve (Project creator here)
  - ahachete 3y ago
    > Many of the core features are open source. Out of the 15 features I see in https://supertokens.com/pricing https://supertokens.com/pricing, 7 are only proprietary. That's roughly half of them. Without qualifying the weight of every feature, it numerically raises a significant challenge to your statement. SAML, OAuth and 2FA strike me as key components for me that are not open source. --- So I stand by my words. I feel put off by a wording that makes me believe a project is open source, when it is open core. Even if you don't like open core or argue the definition is not clear (which I'd disagree), at least marketing it as open source so prominently is IMO misleading, and puts me off (and apparently I'm not alone here). It's fair to have a business model on open source (obviously!) and I wish you all the luck. But being honest about your business model choices should be the #1 tenet.
ygt1qa8 3y ago
I am more interested in Logto than supertokens https://github.com/logto-io/logto https://github.com/logto-io/logto
- mooreds 3y ago
  Why? I work for another auth provider (FusionAuth), so always interested in learning about other solutions. What's Logto's special sauce? I see it uses the MPL and is a CIAM solution, written in Typescript. What else is unique about it/why should someone pick it over the other options?
Whiteshadow12 3y ago
Any solutions for Elixir and Phoenix, we currently have component and live view is leveling up quite nicely to be able to isolate the auth from the DB/App.
- rishabhpoddar 3y ago
  We don't have SDKs for these yet, but you can always spin up a node process with our node SDK and use that as the auth server for your Elixir app. The node process would create a session and issue JWTs to the frontend which can be sent to the Elixir backend for API auth.
- mooreds 3y ago
  This is one example where OIDC support would be great. Elixir has a library with OIDC support: https://hexdocs.pm/openid_connect/readme.html https://hexdocs.pm/openid_connect/readme.html
andix 3y ago
For some people the missing OpenID Connect may be a feature. But it provides some sort of vendor lock-in. A lot of components can easily be attached via OIDC and i would not use an authentication provider/middleware without OIDC support.
- rishabhpoddar 3y ago
  Fair enough. We are in the process of adding this feature.
  - olligo 3y ago
    That would make integration with Wundergraph possible: https://docs.wundergraph.com/docs/auth/cookie-based-auth/openid-connect https://docs.wundergraph.com/docs/auth/cookie-based-auth/ope...
- mooreds 3y ago
  Disclosure: I work for FusionAuth, a competitor. Yes, OIDC is quite important for the central identity hub, especially when you get beyond custom apps. If you are building an app, Supertokens with their SDKs and APIs might be a great choice. As soon as you start wanting to integrate with other COTS or OSS applications (a forum, help desk software, slack/teams), you'll need OIDC (or perhaps SAML, depending on the age of the software) support.
rigelbm 3y ago
Nice product. It's always good to see more choices in the authz space. I think Ory (Kratos) is a critical omission in the comparissons page, given the Ory suite seems to be one of the top alternatives currently for OSS authz/authn. Hopefully the omission is fixed soon.
vcryan 3y ago
For those concerned about the license, you can go right ahead and fork the open-source parts and start coordinating the development of any of the non-open parts on your fully open version. Personally, I appreciate the parts that have been made open and love that they could be the foundation of a fully open solution that is viable for organizations of any size. There is no offense in doing this, as this company has intentionally selected to license part of their code to facilitate thus type of competition in the software eco-system. They are betting than no one could sustain an fully open alternative, and therefore their open-core business model is viable. Maybe they are right-- maybe not.
vrglvrglvrgl 3y ago
[dead]
_jezell_ 3y ago
Stopped reading at "Why Java"
hsluoyz 3y ago
Another open-source IAM solution called Casdoor looks better than supertokens, it's fully open-source https://github.com/casdoor/casdoor https://github.com/casdoor/casdoor
thesausageking 3y ago
Not fully open source and run by a tiny startup that last raised funding 3 years ago means it's way too risky to use in a real product. Firebase and Cognito have issues, but for something as mission critical to a product as auth and identity knowing the service won't be killed or acquired is too important.
- advaitruia 3y ago
  We've raised money every year in the last 3 years. We just dont update crunchbase. we're being used at scale of millions of monthly active companies by very large companies - which have done deep technical evaluation. If the company dies or gets acquired (possible with companies of almost all stages), the product is actually open source. You can self host it without any permissions and we provide daily database backups
  - thesausageking 3y ago
    "open core" != open source. I've been burned by too many YC startups that go away and leave customers stranded to use one for something as important as auth.

212 points by nateb2022 3y ago

The fact that it's written in java made me lose interest. I just can't afford hiring a jvm specialist to tune jvm deployments

rishabhpoddar 3y ago
We provide a docker container which manages running the SuperTokens core (the java part) for you. You can easily run several of these behind a load balancer and scale to millions of MAU. We have several users who have done this with no java knowledge whatsoever.
- chayesfss 3y ago
  [dead]
Eldt 3y ago
Why would you need to tune the JVM, and why would you need a specialist for that?
- booi 3y ago
  Well you really should manage the amount of memory available to Java.. ie the -Xms and -Xmx values at high scale. That generally all that’s needed 95% of the time. Maybe the commenter is not comfortable with this?
  - re-thc 3y ago
    It doesn't sound like a specialist task if it happens 95% of the time. The commenter just wanted to bash Java for no reason.

aweheel 3y ago

How does this differentiate from other open source identity solutions like KeyCloak or Ory? I wish there was more collaboration in this space, especially singe we’re talking security and these projects need pen testing, bug bounties, and more infrastructure to be considered „production grade“.

wvv 3y ago
There is a comparison chart available: https://supertokens.com/pricing#comparison-chart https://supertokens.com/pricing#comparison-chart
- aweheel 3y ago
  Putting user satisfaction in the chart and not backing it with sources (I know at least a handful of companies who are very satisfied with e.g. KeyCloak) does not instill lots of confidence in the product differentiation. And what does customizability mean? KeyCloak has a rich Plugin system. Other than that it seems to be quite equal, if you discount the more difficult things in Auth like providing standardized APIs, OAuth2 APIs and SCIM.
  - advaitruia 3y ago
    Yes, its a very subjective point. We've mentioned the source (if you hover) and it is based on our internal user research and conversations with users of these products. By no means is it perfect and there are many many satisfied customers of each of the other products. Your point is taken though and maybe we will edit that point out or try to add further nuance. I do believe however that broadly speaking, that reviews of keycloak lean towards it being relatively harder to use and maintain than Firebase. Arguably the reviews of Cognito are more mixed than "Low"
  - robertlagrant 3y ago
    It's tricky to make these marketing charts objective. It would be good to have a real comparison somewhere.
- 3y ago

netzego 3y ago

"[...] it is forbidden to copy, merge, publish, distribute, sublicense, and/or sell the Software." [1] "Open source is source code that is made freely available for possible modification and redistribution." [2] [1] https://github.com/supertokens/supertokens-core/blob/master/ee/LICENSE.md https://github.com/supertokens/supertokens-core/blob/master/... [2] https://en.wikipedia.org/wiki/Open_source https://en.wikipedia.org/wiki/Open_source

jorams 3y ago
That is the license for the contents of the "ee" directory. The top-level LICENSE is Apache 2.0. I don't know to what extent this code is integrated into the rest, but it's a valid way to develop open-core software.
- Lacerda69 3y ago
  What features of supertokens are not open source and part of that "enterprise" directory?
  - pmontra 3y ago
    I see a feature flag and a license check class. https://github.com/supertokens/supertokens-core/tree/master/ee/src/main/java/io/supertokens/ee https://github.com/supertokens/supertokens-core/tree/master/...
  - hobofan 3y ago
    As of right now, nothing. The only thing that is in there is a license key checker and basic infrastructure for feature flags.
- netzego 3y ago
  "The concept of open-core software has proven to be controversial, as many developers do not consider the business model to be true open-source software. Despite this, open-core models are used by many [...] software companies." [1] [1] https://en.wikipedia.org/wiki/Open-core_model https://en.wikipedia.org/wiki/Open-core_model I rather go with this definition. Opensource != opencore. Despite this, you're right, that is the license for `ee` folder.

ahachete 3y ago

This is an Open Core product. The open source part of it seems to be quite limited (see https://supertokens.com/pricing https://supertokens.com/pricing) and therefore I have a hard time believing this version can be "an alternative to [...]". Actually, the main motto of the frontpage is "Open Source User Authentication", which I also think is a bit of a mischaracterization of the software, since key features I'd look for on an authentication software are not open source. I love that this is a Java-based project and the goals and ideas behind it; but I think the so prominent use of the terms "open source" is misleading and I recommend demoting them or using alternative terms to reflect a more precise reality.

advaitruia 3y ago
Many of the core features are open source. Eg all the authentication methods - email password, passwordless, social etc are all in the open source product. You can also use the open source components to implement email based or SMS based 2FA. RBAC, session management and user management dashboard are open source too. Its several years of an engineering team's work that is all open source. Our philosophy is to keep features that are broadly required by developers and small companies in the open source version. Things that large companies require, will be source available. We have several enterprises (more than $100M raised or several hundred employees) that are using SuperTokens at the scale of millions of monthly active users - all using the open source product. We think the open source product is a sufficient alternative (for a large enough population). Are there any other features you feel should be in the open source version? Happy to hear any feedback and improve (Project creator here)
- ahachete 3y ago
  > Many of the core features are open source. Out of the 15 features I see in https://supertokens.com/pricing https://supertokens.com/pricing, 7 are only proprietary. That's roughly half of them. Without qualifying the weight of every feature, it numerically raises a significant challenge to your statement. SAML, OAuth and 2FA strike me as key components for me that are not open source. --- So I stand by my words. I feel put off by a wording that makes me believe a project is open source, when it is open core. Even if you don't like open core or argue the definition is not clear (which I'd disagree), at least marketing it as open source so prominently is IMO misleading, and puts me off (and apparently I'm not alone here). It's fair to have a business model on open source (obviously!) and I wish you all the luck. But being honest about your business model choices should be the #1 tenet.

ygt1qa8 3y ago

I am more interested in Logto than supertokens https://github.com/logto-io/logto https://github.com/logto-io/logto

mooreds 3y ago
Why? I work for another auth provider (FusionAuth), so always interested in learning about other solutions. What's Logto's special sauce? I see it uses the MPL and is a CIAM solution, written in Typescript. What else is unique about it/why should someone pick it over the other options?

Whiteshadow12 3y ago

Any solutions for Elixir and Phoenix, we currently have component and live view is leveling up quite nicely to be able to isolate the auth from the DB/App.

rishabhpoddar 3y ago
We don't have SDKs for these yet, but you can always spin up a node process with our node SDK and use that as the auth server for your Elixir app. The node process would create a session and issue JWTs to the frontend which can be sent to the Elixir backend for API auth.
mooreds 3y ago
This is one example where OIDC support would be great. Elixir has a library with OIDC support: https://hexdocs.pm/openid_connect/readme.html https://hexdocs.pm/openid_connect/readme.html

andix 3y ago

For some people the missing OpenID Connect may be a feature. But it provides some sort of vendor lock-in. A lot of components can easily be attached via OIDC and i would not use an authentication provider/middleware without OIDC support.

rishabhpoddar 3y ago
Fair enough. We are in the process of adding this feature.
- olligo 3y ago
  That would make integration with Wundergraph possible: https://docs.wundergraph.com/docs/auth/cookie-based-auth/openid-connect https://docs.wundergraph.com/docs/auth/cookie-based-auth/ope...
mooreds 3y ago
Disclosure: I work for FusionAuth, a competitor. Yes, OIDC is quite important for the central identity hub, especially when you get beyond custom apps. If you are building an app, Supertokens with their SDKs and APIs might be a great choice. As soon as you start wanting to integrate with other COTS or OSS applications (a forum, help desk software, slack/teams), you'll need OIDC (or perhaps SAML, depending on the age of the software) support.

rigelbm 3y ago

Nice product. It's always good to see more choices in the authz space. I think Ory (Kratos) is a critical omission in the comparissons page, given the Ory suite seems to be one of the top alternatives currently for OSS authz/authn. Hopefully the omission is fixed soon.

vcryan 3y ago

For those concerned about the license, you can go right ahead and fork the open-source parts and start coordinating the development of any of the non-open parts on your fully open version. Personally, I appreciate the parts that have been made open and love that they could be the foundation of a fully open solution that is viable for organizations of any size. There is no offense in doing this, as this company has intentionally selected to license part of their code to facilitate thus type of competition in the software eco-system. They are betting than no one could sustain an fully open alternative, and therefore their open-core business model is viable. Maybe they are right-- maybe not.

vrglvrglvrgl 3y ago

[dead]

_jezell_ 3y ago

Stopped reading at "Why Java"

hsluoyz 3y ago

Another open-source IAM solution called Casdoor looks better than supertokens, it's fully open-source https://github.com/casdoor/casdoor https://github.com/casdoor/casdoor

thesausageking 3y ago

Not fully open source and run by a tiny startup that last raised funding 3 years ago means it's way too risky to use in a real product. Firebase and Cognito have issues, but for something as mission critical to a product as auth and identity knowing the service won't be killed or acquired is too important.

advaitruia 3y ago
We've raised money every year in the last 3 years. We just dont update crunchbase. we're being used at scale of millions of monthly active companies by very large companies - which have done deep technical evaluation. If the company dies or gets acquired (possible with companies of almost all stages), the product is actually open source. You can self host it without any permissions and we provide daily database backups
- thesausageking 3y ago
  "open core" != open source. I've been burned by too many YC startups that go away and leave customers stranded to use one for something as important as auth.