4 ms·

Making SSO a premium feature isn't any different from the paid SSL of the 2000s. You'll reduce security and safety just to segment the market. And in my experi

Making SSO a premium feature isn't any different from the paid SSL of the 2000s. You'll reduce security and safety just to segment the market. And in my experience, SSO doesn't need to be expensive. SAML and Kerberos should be expensive, sure. But OIDC with standard seevices such as Google, GitHub, Okta or Keycloak should absolutely be part of the base package. Personally, I'll just build the open core version from source and add all the "enterprise" features like SSO, S3 and Prometheus metrics myself.

tptacek 2y ago
"Need" has nothing to do with why SSO is expensive. There is no meaningful difference, from a business model perspective, between SAML and OIDC (though: don't do SAML). SSO is expensive because customers that require it are less price sensitive than customers that don't. By all means: build your own SSO on the open core of products that charge for SSO. I promise: the companies don't really care that you're doing this. You're profoundly segmenting yourself out by doing that.
- kuschku 2y ago
  > There is no meaningful difference, from a business model perspective, between SAML and OIDC (though: don't do SAML). Oh there absolutely is. The customers that use OIDC use a relatively light stack and are generally okay with relatively simple setups. They're usually startups and are also the ones that can feasibly add SSO into your app themselves. The customers that need SAML are older, larger companies often with a custom mix of multiple hybrid AD and AzureAD directories for each department that need special handling with custom properties and realtime sync. You'll be spending at least a few engineer-months on support for them. I've been on both sides previously, I've seen it all.
  - tptacek 2y ago
    That's all fascinating, and I've done security assessments of about a dozen SAML implementations (don't do SAML) and have built several OIDC SSO implementations (whatever I'm fine with OIDC), but none of this has anything to do with product pricing.
- Dylan16807 2y ago
  Well you focused pretty hard on the word need, but do you disagree with "Making SSO a premium feature isn't any different from the paid SSL of the 2000s. You'll reduce security and safety just to segment the market."?

tptacek 2y ago

"Need" has nothing to do with why SSO is expensive. There is no meaningful difference, from a business model perspective, between SAML and OIDC (though: don't do SAML). SSO is expensive because customers that require it are less price sensitive than customers that don't. By all means: build your own SSO on the open core of products that charge for SSO. I promise: the companies don't really care that you're doing this. You're profoundly segmenting yourself out by doing that.

kuschku 2y ago
> There is no meaningful difference, from a business model perspective, between SAML and OIDC (though: don't do SAML). Oh there absolutely is. The customers that use OIDC use a relatively light stack and are generally okay with relatively simple setups. They're usually startups and are also the ones that can feasibly add SSO into your app themselves. The customers that need SAML are older, larger companies often with a custom mix of multiple hybrid AD and AzureAD directories for each department that need special handling with custom properties and realtime sync. You'll be spending at least a few engineer-months on support for them. I've been on both sides previously, I've seen it all.
- tptacek 2y ago
  That's all fascinating, and I've done security assessments of about a dozen SAML implementations (don't do SAML) and have built several OIDC SSO implementations (whatever I'm fine with OIDC), but none of this has anything to do with product pricing.
Dylan16807 2y ago
Well you focused pretty hard on the word need, but do you disagree with "Making SSO a premium feature isn't any different from the paid SSL of the 2000s. You'll reduce security and safety just to segment the market."?