4 ms·

Seems like a good place to ask: Does anyone have advice on good solutions for B2B SAAS apps? Just our app that needs logging in to and would like to allow the

by aidos 3y ago

Seems like a good place to ask: Does anyone have advice on good solutions for B2B SAAS apps? Just our app that needs logging in to and would like to allow the usual things (password, social etc) but also allow customising the rules per email domain. For example, if someone enters someone@example.com in to the login form they'll be shuffled off to this Azure connection for authentication. Or maybe they use our login pages, but MFA is enforced. Things that I've tried (eg Authentik and FusionAuth) weren't well suited for per organisation controls.

arekkas 3y ago
We have this feature and it is called B2B SSO: https://www.ory.sh/docs/kratos/organizations https://www.ory.sh/docs/kratos/organizations
- aidos 3y ago
  Interesting. Any more details available on what’s configurable? How does it work out pricing wise?
  - arekkas 3y ago
    The flow is essentially what you see in the small video on the docs page and can be set up in the Ory Network Console with a few clicks. I agree though that the docs here are a bit thin. Pricing wise this is available on the Scale tier currently dubbed as "Enterprise SSO" although "B2B Organizations" probably would be more correct: https://www.ory.sh/pricing/ https://www.ory.sh/pricing/ There are no limits to how many organizations you can have. Regarding MFA - the MFA enforcement typically is the responsibility of the IDP the company owns. So for example dean@companyA.com use Okta and they enforce 2FA for their users. anna@companyB.com use OneLogin and they do not enforce MFA.
    - aidos 3y ago
      Thanks. In terms of other enforcement, I meant more wrt to an organisation that _didn't_ use another IDP but still wanted to apply PW policies (for example) on their domain. Could you create an Ory project (sorry, don't know all your terminology) to forward on to? Something like: Our app -> Ory -> split by domain -> Ory for specific domain -> Policies.
    - lmeyerov 3y ago
      So not OSS?
mooreds 3y ago
Hmm. (I work for FusionAuth, thanks for giving us a try!) So you want a screen in front of the login process where someone enters their email address, and then a second screen where a variety of login options are presented? Along with the ability to enforce MFA on a per domain basis? Anything else you are looking to customize at the domain level, such as password rules or registration ability?
- aidos 3y ago
  For the moment our needs are actually fairly light. I'm trying to remember exactly what I ran into with FusionAuth but struggling a little unfortunately.
  - mooreds 3y ago
    Gotcha. We definitely don't have fine granularity around when MFA is required (open issue here: https://github.com/FusionAuth/fusionauth-issues/issues/2285 https://github.com/FusionAuth/fusionauth-issues/issues/2285 ). Other than that I'd suggest putting a page in front of our login pages with the domain logic, and modeling each set of emails as either an application, organization or tenant, depending on the specific features you need. Either way, hope you find the right solution for your needs!
    - aidos 3y ago
      Thanks. I appreciate the info. Will give it a shot when I revisit this in a month or so.
mffap 3y ago
Have a look at ZITADEL (https://github.com/zitadel/zitadel https://github.com/zitadel/zitadel or https://zitadel.com/ https://zitadel.com/), I think that does what you want. You can create multiple tenants (called Organizations) and you can setup security / login rules per organization such as enforcing MFA. Furthermore you can configure on each tenant a separate SSO and users are directly forwarded to their identity provider. When you first enter your username (could be an email) on the login screen, the policies of the user's organization will be applied. That allows you to route users based on their email domain etc. One additional thing to mention is that ZITADEL does not only handle authentication, but also authorization with self-service. Managers of an organization can, for example, assign users of their organization roles.
- aidos 3y ago
  That sounds like just what I want. ZITADEL was already on my list to try in the next round. Can you clarify the pricing / plan required for that feature set?
  - andix 3y ago
    Hmm, maybe take a look at their website? https://zitadel.com/pricing https://zitadel.com/pricing
  - mffap 3y ago
    All of these features are included. Main drivers for pricing in this case, I assume will be daily active users (sum over the month) and how many third-party identity providers you have configured. Unlimited tenants, users, permissions etc. are included. We use DAU instead of MAU, since there are many different use cases and that seems work quite well. Just take the MAU and multiply by how many times per month your users will sign-in. In the enterprise tier we offer more custom quotes for higher volumes, guarantee requirements, and support SLAs.
    - aidos 3y ago
      And to clarify on the third party providers. Assuming every org is using Azure - that’s 1 provider per org. So 53 orgs would be an extra $1,000 / month?
grinich 3y ago
Have you tried WorkOS? It’s built for exactly this, with native support for SAML and SCIM. https://workos.com/ https://workos.com/ I’m the founder. Would love to hear your feedback and happy to answer questions.
- aidos 3y ago
  No, I haven’t tried it. It looks great but unfortunately the per connection pricing makes it not ideal for us. (We’ve had a couple of messages back and forth on here in the past about it). Most of our customers have low numbers of users, so the per subscription cost becomes a bit high. I’ll kick the tyres in my next round of investigation though to see how it looks.
  - esafak 3y ago
    What's on your shortlist?
BeryJu 3y ago
Hey, for authentik this is actually something we're actively working on: https://github.com/goauthentik/authentik/pull/8330 https://github.com/goauthentik/authentik/pull/8330, and this will be included in our next feature release in April! (Disclaimer, I am founder and CTO of authentik)
mcstempel 3y ago
We built Stytch's B2B SaaS solution with this specific shortcoming in mind -- most other solutions aren't actually built with an organization-first data model (they're user-first like Auth0 but support the general concept of orgs), which makes it difficult to offer those per organization controls in an ergonomic manner. There's some more info on our multi-tenancy data model here (https://stytch.com/docs/b2b/guides/multi-tenancy https://stytch.com/docs/b2b/guides/multi-tenancy), and here's the PUT request you'd use to manage any of those org configurations: https://stytch.com/docs/b2b/api/update-organization https://stytch.com/docs/b2b/api/update-organization
- aidos 3y ago
  That looks really close to what I’m after! Will give it a spin.
esafak 3y ago
Most of the commercial solutions break financially when you have a freemium tier; orgs that don't pay below a certain size or usage. Yet the auth provider charges you the same fee for each such org.
nickzelei 3y ago
I’m also interested in this. We’ve been using Auth0 for a year and our contract is up for renewal where we will be getting kicked off of the startup plan. I’m wanting to rip the bandaid off early as we’re about to launch a new platform. I’m highly considering bringing auth in house with Keycloak. I’ve run it in the past at previous companies so am familiar with it, but it’s going to be an extra thing to maintain due to self hosting, their themeing also is not great. However this is pretty much an end all solution that doesn’t really get expensive over time as our user base grows. Wondering if folks have any advice?
jwineinger 3y ago
Auth0 can do this. Identifier first login, SSO domain aliases, and MFA are all supported. They have an Organizations feature as well, but I'm not certain if you'd need that from what you've described. Customization of various aspects of the authn flow can be done via Actions (and Rules, but they're deprecated).

by aidos 3y ago

arekkas 3y ago

We have this feature and it is called B2B SSO: https://www.ory.sh/docs/kratos/organizations https://www.ory.sh/docs/kratos/organizations

aidos 3y ago
Interesting. Any more details available on what’s configurable? How does it work out pricing wise?
- arekkas 3y ago
  The flow is essentially what you see in the small video on the docs page and can be set up in the Ory Network Console with a few clicks. I agree though that the docs here are a bit thin. Pricing wise this is available on the Scale tier currently dubbed as "Enterprise SSO" although "B2B Organizations" probably would be more correct: https://www.ory.sh/pricing/ https://www.ory.sh/pricing/ There are no limits to how many organizations you can have. Regarding MFA - the MFA enforcement typically is the responsibility of the IDP the company owns. So for example dean@companyA.com use Okta and they enforce 2FA for their users. anna@companyB.com use OneLogin and they do not enforce MFA.
  - aidos 3y ago
    Thanks. In terms of other enforcement, I meant more wrt to an organisation that _didn't_ use another IDP but still wanted to apply PW policies (for example) on their domain. Could you create an Ory project (sorry, don't know all your terminology) to forward on to? Something like: Our app -> Ory -> split by domain -> Ory for specific domain -> Policies.
  - lmeyerov 3y ago
    So not OSS?

mooreds 3y ago

Hmm. (I work for FusionAuth, thanks for giving us a try!) So you want a screen in front of the login process where someone enters their email address, and then a second screen where a variety of login options are presented? Along with the ability to enforce MFA on a per domain basis? Anything else you are looking to customize at the domain level, such as password rules or registration ability?

aidos 3y ago
For the moment our needs are actually fairly light. I'm trying to remember exactly what I ran into with FusionAuth but struggling a little unfortunately.
- mooreds 3y ago
  Gotcha. We definitely don't have fine granularity around when MFA is required (open issue here: https://github.com/FusionAuth/fusionauth-issues/issues/2285 https://github.com/FusionAuth/fusionauth-issues/issues/2285 ). Other than that I'd suggest putting a page in front of our login pages with the domain logic, and modeling each set of emails as either an application, organization or tenant, depending on the specific features you need. Either way, hope you find the right solution for your needs!
  - aidos 3y ago
    Thanks. I appreciate the info. Will give it a shot when I revisit this in a month or so.

mffap 3y ago

Have a look at ZITADEL (https://github.com/zitadel/zitadel https://github.com/zitadel/zitadel or https://zitadel.com/ https://zitadel.com/), I think that does what you want. You can create multiple tenants (called Organizations) and you can setup security / login rules per organization such as enforcing MFA. Furthermore you can configure on each tenant a separate SSO and users are directly forwarded to their identity provider. When you first enter your username (could be an email) on the login screen, the policies of the user's organization will be applied. That allows you to route users based on their email domain etc. One additional thing to mention is that ZITADEL does not only handle authentication, but also authorization with self-service. Managers of an organization can, for example, assign users of their organization roles.

aidos 3y ago
That sounds like just what I want. ZITADEL was already on my list to try in the next round. Can you clarify the pricing / plan required for that feature set?
- andix 3y ago
  Hmm, maybe take a look at their website? https://zitadel.com/pricing https://zitadel.com/pricing
- mffap 3y ago
  All of these features are included. Main drivers for pricing in this case, I assume will be daily active users (sum over the month) and how many third-party identity providers you have configured. Unlimited tenants, users, permissions etc. are included. We use DAU instead of MAU, since there are many different use cases and that seems work quite well. Just take the MAU and multiply by how many times per month your users will sign-in. In the enterprise tier we offer more custom quotes for higher volumes, guarantee requirements, and support SLAs.
  - aidos 3y ago
    And to clarify on the third party providers. Assuming every org is using Azure - that’s 1 provider per org. So 53 orgs would be an extra $1,000 / month?

grinich 3y ago

Have you tried WorkOS? It’s built for exactly this, with native support for SAML and SCIM. https://workos.com/ https://workos.com/ I’m the founder. Would love to hear your feedback and happy to answer questions.

aidos 3y ago
No, I haven’t tried it. It looks great but unfortunately the per connection pricing makes it not ideal for us. (We’ve had a couple of messages back and forth on here in the past about it). Most of our customers have low numbers of users, so the per subscription cost becomes a bit high. I’ll kick the tyres in my next round of investigation though to see how it looks.
- esafak 3y ago
  What's on your shortlist?

BeryJu 3y ago

Hey, for authentik this is actually something we're actively working on: https://github.com/goauthentik/authentik/pull/8330 https://github.com/goauthentik/authentik/pull/8330, and this will be included in our next feature release in April! (Disclaimer, I am founder and CTO of authentik)

mcstempel 3y ago

We built Stytch's B2B SaaS solution with this specific shortcoming in mind -- most other solutions aren't actually built with an organization-first data model (they're user-first like Auth0 but support the general concept of orgs), which makes it difficult to offer those per organization controls in an ergonomic manner. There's some more info on our multi-tenancy data model here (https://stytch.com/docs/b2b/guides/multi-tenancy https://stytch.com/docs/b2b/guides/multi-tenancy), and here's the PUT request you'd use to manage any of those org configurations: https://stytch.com/docs/b2b/api/update-organization https://stytch.com/docs/b2b/api/update-organization

aidos 3y ago
That looks really close to what I’m after! Will give it a spin.

esafak 3y ago

Most of the commercial solutions break financially when you have a freemium tier; orgs that don't pay below a certain size or usage. Yet the auth provider charges you the same fee for each such org.

nickzelei 3y ago

I’m also interested in this. We’ve been using Auth0 for a year and our contract is up for renewal where we will be getting kicked off of the startup plan. I’m wanting to rip the bandaid off early as we’re about to launch a new platform. I’m highly considering bringing auth in house with Keycloak. I’ve run it in the past at previous companies so am familiar with it, but it’s going to be an extra thing to maintain due to self hosting, their themeing also is not great. However this is pretty much an end all solution that doesn’t really get expensive over time as our user base grows. Wondering if folks have any advice?

jwineinger 3y ago

Auth0 can do this. Identifier first login, SSO domain aliases, and MFA are all supported. They have an Organizations feature as well, but I'm not certain if you'd need that from what you've described. Customization of various aspects of the authn flow can be done via Actions (and Rules, but they're deprecated).