4 ms·

Who would you recommend as an iDP if not Okta?

Nextgrid 3y ago
At this point any self-hosted option would do just as well. Not perfect, but not only it would require a targeted attack to pwn, but if you do end up pwned at least you weren't paying tens of thousands a year for the privilege.
- ghshephard 3y ago
  I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. It would be the equivalent of trying to self-host email. Also - never having worked for a company that hosted their own - what's the experience like - with Okta, you can essentially SSO onto hundreds (thousands?) of different cloud service providers. Similiar if you self-host?
  - Nextgrid 3y ago
    > I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. Not saying you can do better, just saying that you can get the same level of quality for free without paying for an incompetent & expensive snake-oil vendor. But if you want a non-exhaustive list, there are a few lessons we can learn at Okta's expense: Not outsource support to low-wage boiler rooms could be a good start - that's what got them their previous breach some time ago, and the current breach isn't that far off although it seems more down to the support infrastructure than the people themselves. If you can, restrict access per IP address. Even better, if everyone works out of the office or VPNs into it, don't expose the service publicly in the first place. Defense in depth, something we seem to have forgot in the process of putting everything on the public internet. If you see an existing session token suddenly show up with a different user-agent and IP address (not matching previous usage patterns or expected wifi-to-mobile handover), invalidate the session and ask the user to reauth again. If possible, high-value accounts need to be IP restricted in the first place to known IPs or at least subnets (if the employee is on a dynamic IP).
  - mike_d 3y ago
    > I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. If you use Okta, every single Okta support person is a super-admin in your environment with access to every role in every app. It is trivial to do better than that.
    - nixgeek 3y ago
      It’s extremely unlikely that every Okta Support employee has this level of access, much less on a persistent ongoing basis. It would be nearly impossible to achieve this level of compliance certification if it were this simple and this broken. https://www.okta.com/trust-page/compliance/ https://www.okta.com/trust-page/compliance/
      - Veserv 3y ago
        Why do you have a link: https://www.okta.com/trust-page/compliance/ https://www.okta.com/trust-page/compliance/ to the list of Okta certifications in your bookmarks? You absolutely did not do a search for it just now because that is a stale link so there is no way you even clicked through that link before pasting it and you already knew what was supposed to be on that page. This is the current link: https://trust.okta.com/compliance/ https://trust.okta.com/compliance/ And anyways, yeah, those certifications are useless box checking garbage that a totally broken system can get. Solarwinds has most of those same certifications: https://www.solarwinds.com/trust-center https://www.solarwinds.com/trust-center and they are a total clown show. In fact, basically all of the clown shows have those because all most of those standards amount to is verifying your paperwork is consistent.
        nixgeek 3y ago
        I got that back from a search and do not have it in my bookmarks, and I did quickly skim it before pasting as well. You have a creative imagination about how I use the internet though, sorry.
        Veserv 3y ago
- thephyber 3y ago
  This is not a serious answer. It’s very unlikely that “any self-hosted option” actually competes with Okta’s IDP solutions, has really decent security, has very good logging features, has behavior analysis features to detect login/session anomalies, and has security staff to respond to those threats quickly. Saying “just self-host anything” makes a massive assumption that your company can afford to compete against Okta/Google for the same talent. Some companies can, but the vast majority of Okta’s user base can’t. You would be fighting against specialization and comparative advantage. It might be possible that there are significantly better options than Okta, but I have yet to find them.
  - Nextgrid 3y ago
    > has really decent security Okta has a major insider threat problem though (either their employees/subcontractors get pwned like last time, or their infra gets pwned like now). I would expect much better from a "security" vendor, and since they consistently fail at it, I wonder what else they fail at that we don't (yet) know. > has behavior analysis features to detect login/session anomalies This is what baffles me. Given the description of the attack some attacker reused a stolen session token from a different IP address (not sure if they bothered to spoof the UA) - how was this not immediately challenged, especially for a high-value account? I indeed expected this to get flagged immediately. > that your company can afford to compete against Okta/Google for the same talent Not sure about Google, but given the (repeated!) breaches, Okta can't compete for talent either, or that talent isn't actually everything. A big advantage of self-hosting is that you reduce your exposure to opportunistic and "for the lulz" attacks - if someone breaches Okta, it's trivial for them to automatically pwn everyone. If you self-host, they'd have to know you exist and target you specifically - that doesn't scale. Plus you can layer extra security on top such as VPN and then your IdP is invisible from the outside and a potential attacker would first need a VPN exploit before they can even do the initial recon to find out what's your IdP and its vulnerabilities. Can't do that with Okta. The consistent pattern of breaches and their nature makes me believe they are not a serious vendor worthy of the price or the trust people put in them, and missing a better option I'd rather self-host - all else being equal, at least it would save on the fees.
  - lopkeny12ko 3y ago
latchkey 3y ago
Personally, I'm fine with Google Workspace. IMHO, their track record for corporate auth, over the last what... decade... has been very good.
- x0x0 3y ago
  Their security record is fantastic, but afaik they don't do what okta does. Okta: comprehensive scim allowing your IT instead of random application admins throughout your company to manage user provisioning / deprovisioning. Start pages that don't require users to remember urls but instead show them a list of applications they can use. Adaptive MFA with IT-administered settings (though Google's super-enterprisey solutions may have sth here.)
radlad 3y ago
I'm partial to Duo SSO because I helped build it (though I haven't worked there for years now.) There's also OneLogin, Jumpcloud, or you can use Google Workspace and I think Azure AD too.
- vladvasiliu 3y ago
  > and I think Azure AD too Not sure that "security" should be the top reason for switching from Okta to AzureAD. Also, as a "user" (in IT), AAD is a royal PITA to use, with stupid limitations, such as not supporting group hierarchies. And don't even get me started on the horrid UX of the Azure portal. I've never used Okta in any capacity, though, so I don't know if it's any better.

At this point any self-hosted option would do just as well. Not perfect, but not only it would require a targeted attack to pwn, but if you do end up pwned at least you weren't paying tens of thousands a year for the privilege.

ghshephard 3y ago
I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. It would be the equivalent of trying to self-host email. Also - never having worked for a company that hosted their own - what's the experience like - with Okta, you can essentially SSO onto hundreds (thousands?) of different cloud service providers. Similiar if you self-host?
- Nextgrid 3y ago
  > I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. Not saying you can do better, just saying that you can get the same level of quality for free without paying for an incompetent & expensive snake-oil vendor. But if you want a non-exhaustive list, there are a few lessons we can learn at Okta's expense: Not outsource support to low-wage boiler rooms could be a good start - that's what got them their previous breach some time ago, and the current breach isn't that far off although it seems more down to the support infrastructure than the people themselves. If you can, restrict access per IP address. Even better, if everyone works out of the office or VPNs into it, don't expose the service publicly in the first place. Defense in depth, something we seem to have forgot in the process of putting everything on the public internet. If you see an existing session token suddenly show up with a different user-agent and IP address (not matching previous usage patterns or expected wifi-to-mobile handover), invalidate the session and ask the user to reauth again. If possible, high-value accounts need to be IP restricted in the first place to known IPs or at least subnets (if the employee is on a dynamic IP).
- mike_d 3y ago
  > I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. If you use Okta, every single Okta support person is a super-admin in your environment with access to every role in every app. It is trivial to do better than that.
  - nixgeek 3y ago
    It’s extremely unlikely that every Okta Support employee has this level of access, much less on a persistent ongoing basis. It would be nearly impossible to achieve this level of compliance certification if it were this simple and this broken. https://www.okta.com/trust-page/compliance/ https://www.okta.com/trust-page/compliance/
    - Veserv 3y ago
      Why do you have a link: https://www.okta.com/trust-page/compliance/ https://www.okta.com/trust-page/compliance/ to the list of Okta certifications in your bookmarks? You absolutely did not do a search for it just now because that is a stale link so there is no way you even clicked through that link before pasting it and you already knew what was supposed to be on that page. This is the current link: https://trust.okta.com/compliance/ https://trust.okta.com/compliance/ And anyways, yeah, those certifications are useless box checking garbage that a totally broken system can get. Solarwinds has most of those same certifications: https://www.solarwinds.com/trust-center https://www.solarwinds.com/trust-center and they are a total clown show. In fact, basically all of the clown shows have those because all most of those standards amount to is verifying your paperwork is consistent.
      - nixgeek 3y ago
        I got that back from a search and do not have it in my bookmarks, and I did quickly skim it before pasting as well. You have a creative imagination about how I use the internet though, sorry.
        Veserv 3y ago
thephyber 3y ago
This is not a serious answer. It’s very unlikely that “any self-hosted option” actually competes with Okta’s IDP solutions, has really decent security, has very good logging features, has behavior analysis features to detect login/session anomalies, and has security staff to respond to those threats quickly. Saying “just self-host anything” makes a massive assumption that your company can afford to compete against Okta/Google for the same talent. Some companies can, but the vast majority of Okta’s user base can’t. You would be fighting against specialization and comparative advantage. It might be possible that there are significantly better options than Okta, but I have yet to find them.
- Nextgrid 3y ago
  > has really decent security Okta has a major insider threat problem though (either their employees/subcontractors get pwned like last time, or their infra gets pwned like now). I would expect much better from a "security" vendor, and since they consistently fail at it, I wonder what else they fail at that we don't (yet) know. > has behavior analysis features to detect login/session anomalies This is what baffles me. Given the description of the attack some attacker reused a stolen session token from a different IP address (not sure if they bothered to spoof the UA) - how was this not immediately challenged, especially for a high-value account? I indeed expected this to get flagged immediately. > that your company can afford to compete against Okta/Google for the same talent Not sure about Google, but given the (repeated!) breaches, Okta can't compete for talent either, or that talent isn't actually everything. A big advantage of self-hosting is that you reduce your exposure to opportunistic and "for the lulz" attacks - if someone breaches Okta, it's trivial for them to automatically pwn everyone. If you self-host, they'd have to know you exist and target you specifically - that doesn't scale. Plus you can layer extra security on top such as VPN and then your IdP is invisible from the outside and a potential attacker would first need a VPN exploit before they can even do the initial recon to find out what's your IdP and its vulnerabilities. Can't do that with Okta. The consistent pattern of breaches and their nature makes me believe they are not a serious vendor worthy of the price or the trust people put in them, and missing a better option I'd rather self-host - all else being equal, at least it would save on the fees.
- lopkeny12ko 3y ago

latchkey 3y ago

Personally, I'm fine with Google Workspace. IMHO, their track record for corporate auth, over the last what... decade... has been very good.

x0x0 3y ago
Their security record is fantastic, but afaik they don't do what okta does. Okta: comprehensive scim allowing your IT instead of random application admins throughout your company to manage user provisioning / deprovisioning. Start pages that don't require users to remember urls but instead show them a list of applications they can use. Adaptive MFA with IT-administered settings (though Google's super-enterprisey solutions may have sth here.)

radlad 3y ago

I'm partial to Duo SSO because I helped build it (though I haven't worked there for years now.) There's also OneLogin, Jumpcloud, or you can use Google Workspace and I think Azure AD too.

vladvasiliu 3y ago
> and I think Azure AD too Not sure that "security" should be the top reason for switching from Okta to AzureAD. Also, as a "user" (in IT), AAD is a royal PITA to use, with stupid limitations, such as not supporting group hierarchies. And don't even get me started on the horrid UX of the Azure portal. I've never used Okta in any capacity, though, so I don't know if it's any better.