> I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. Not saying you can do better, just sayin

> I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. Not saying you can do better, just saying that you can get the same level of quality for free without paying for an incompetent & expensive snake-oil vendor. But if you want a non-exhaustive list, there are a few lessons we can learn at Okta's expense: Not outsource support to low-wage boiler rooms could be a good start - that's what got them their previous breach some time ago, and the current breach isn't that far off although it seems more down to the support infrastructure than the people themselves. If you can, restrict access per IP address. Even better, if everyone works out of the office or VPNs into it, don't expose the service publicly in the first place. Defense in depth, something we seem to have forgot in the process of putting everything on the public internet. If you see an existing session token suddenly show up with a different user-agent and IP address (not matching previous usage patterns or expected wifi-to-mobile handover), invalidate the session and ask the user to reauth again. If possible, high-value accounts need to be IP restricted in the first place to known IPs or at least subnets (if the employee is on a dynamic IP).