The constant stream of B2B stuff that tends to come with it is the real cost. 95%+ of stuff is indeed technically quite standard and Solved™, like with all thin

The constant stream of B2B stuff that tends to come with it is the real cost. 95%+ of stuff is indeed technically quite standard and Solved™, like with all things oauth... but that last 5% will relentlessly bleed your will to live out of you. Oauth is a massive mess that necessitates libraries with custom tweaks for hundreds of providers, SAML exists but only aging or over-sized B2B touches it so you now have obtuse B2B customers demanding you Address and Attest To Compliance With unrelated PHP CVEs for a Linux distro that's a decade older than the ancient long-term-support version your company started under, plus you're a Ruby shop so wtf even, and... Yeah I've been there. If you can tell B2B to fuck off, it's legitimately easy. If you're running a business around it, they're your major sources of income, you're taken along for their ride and it has absolutely no reason to be Ride-able like that but this is the designed-by-committee world we live in now.