3 ms·

> If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good secu

> If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security. It absolutely is, but it is only applicable to large corporations and won’t help any SMBs. The issue is that this functionality via LDAP/SAML/OODS is frequently locked behind enterprise subscription tiers that usually represent an extremely high markup over other paid tiers. Even in larger corporations, it often not possible to have SSO everywhere. We have multiple „shadow IT“ subscriptions for services that only our team uses. Most of them don’t offer SSO functionality, even for those who do a user base of 5 people is not going to be sufficient to have someone from the responsible departments deal with it. So we have passwords

methou 2y ago
FreeIPA and Authentik works pretty well for me, I did some of this for my self with terraform for fun. Personally I don’t think it’s viable SMB who can’t hire a couple of sysadmins. But the documentation for FreeIPA is especially good. Personally wouldn’t use samba as windows DC, but one legacy windows server license seems reasonable if you are having a few hundreds of employees. In a previous job we’ve done Windows DC + Azure AD + FreeIPA + FreeRadius just fine, the entire setup is not super complicated, but still a headache. I think nowadays most of the thing can be terraformed so it could be easier and more scalable for growing SMBs.
- moooo99 2y ago
  Oh absolutely, I am not talking about the provider side. Sure, it is not trivial, it is doable to set up a central directory and maintain it for relatively affordable. The problem is with the software you are using. A lot of SaaS software has the connection to an SSO provider locked behind an enterprise tier. Take Figma as an example. Their Pro tier is 15€/mo, their Organization tier is 45€/mo. A 3x markup for the lowers tier that supports SSO. And that is among the more reasonable prices. I’ve seen markups of 10x for an enterprise tier that is essential a pro tier + SSO.
  - Helmut10001 2y ago
    That is why (e.g.) we chose grist over nocodb.

methou 2y ago

FreeIPA and Authentik works pretty well for me, I did some of this for my self with terraform for fun. Personally I don’t think it’s viable SMB who can’t hire a couple of sysadmins. But the documentation for FreeIPA is especially good. Personally wouldn’t use samba as windows DC, but one legacy windows server license seems reasonable if you are having a few hundreds of employees. In a previous job we’ve done Windows DC + Azure AD + FreeIPA + FreeRadius just fine, the entire setup is not super complicated, but still a headache. I think nowadays most of the thing can be terraformed so it could be easier and more scalable for growing SMBs.

moooo99 2y ago
Oh absolutely, I am not talking about the provider side. Sure, it is not trivial, it is doable to set up a central directory and maintain it for relatively affordable. The problem is with the software you are using. A lot of SaaS software has the connection to an SSO provider locked behind an enterprise tier. Take Figma as an example. Their Pro tier is 15€/mo, their Organization tier is 45€/mo. A 3x markup for the lowers tier that supports SSO. And that is among the more reasonable prices. I’ve seen markups of 10x for an enterprise tier that is essential a pro tier + SSO.
- Helmut10001 2y ago
  That is why (e.g.) we chose grist over nocodb.