7 ms·
Vendors that treat single sign-on as a luxury feature
- phito 1y agoI wanted to try using n8n in my homelab, but was very disappointed to see the SSO behind a paywall even in the community edition. Bit of a deal breaker for me unfortunately.
- baq 1y agoif you need SSO you have money if you need SSO but you don’t have money, you have issues
- mungoman2 1y agoYes, agreed. What we see is simply a clever way to differentiate the customers that can pay a premium from those that can't. The end goal is to extract the maximum amount of money.
- baq 1y agoI would call it obvious instead of clever, but otherwise fully agreed.
- tptacek 1y agoOr, equivalently, to enable the largest number of customers to use the product, by decreasing prices for smaller customers and increasing them for large ones.
- esseph 1y agoAnd leaves the rest as a security risk
- deleted 1y ago[deleted]
- mmerickel 1y agoThis is just flat-out untrue, OIDC or SAML plus SCIM should be the default for any enterprise-focused service provider or "you're doing it wrong". You can offer your own IDP as the default, but all of the problems that need to be solved to allow your customers to configure their own IDP are important to the design/architecture of your service and the only reason these providers are treating it as special is because they didn't build the integration between their service and their IDP correctly the first time. Provisioning and authentication are critical to security and you're actively harming your customers if you require them to use your own IDP solution in order to use your service.
- datadrivenangel 1y agoAs a volunteer at a volunteer run non-profit, I agree! Nobody makes any more at the org, and it would be great to have SSO for things without having to pay more 150% of our total annual budget to get it...
- simplyinfinity 1y agoI self host a bunch of apps that have SSO as enterprise feature. i want to invite my family/friends into these apps, i don't wanna spend additional 20 000$ for the SSO part, but it be real sweet if i could use it. It would eliminate so much questions like "hey.. what was my login to X?" or "can you reset my password to Y" if i could just use SSO.
- rawfan 1y agoJust use oauth2-proxy with keycloak to put SSO in front of any self-hosted app.
- NewJazz 1y agoWorks if everyone has the same permissions in the app but you might still need a shared login as well. I've done this for e.g. metabase before but it is not the same as a native oidc integration.
- fabian2k 1y agoNot to defend this practice, but SSO does tend to produce an additional support burden. It's complex, there are many knobs to fiddle with and it can be tedious to figure out if the customer (via configuration, or their identity provider itself) or the vendor are at fault for an issue. Just had an issue today, I'm reasonably sure it's the customer's fault. But I also misread the spec earlier and was wrong about some parts that worked out of the box with one identity provider, but not another one. So who knows. Okay, I assume this parts gets better once your SSO implementation gets older, but it's a pain when you're starting out with it.
- NegativeLatency 1y agoEspecially so if the customer is not a tech company or otherwise has IT staff that aren't uh motivated. Add in SCIM and IT people "changing stuff to better align with our other stuff" and you just get a whole steamy barrel of fun.
- mikestorrent 1y agoGod forbid the evil IT department just wants you to have the same username everywhere
- 9dev 1y agoAre you working for Stripe and the issue is names not syncing via SCIM perchance? In that case I’m the customer and reasonably sure it’s your fault ;)
- fabian2k 1y agoNo, it's far, far smaller and very specialized software.
- stackskipton 1y agoYep, I used to deal with this at $LastJob and amount of support burden was terrible. Azure AD/Entra ID (Microsoft IDP) was most common and amount of IT folks who don't have a clue about it is staggering. Companies kicking over issues to us when it's their problem. "Hey, we have a ticket saying MFA Required but account shows as Entra ID." "Send it back with contact their IT team." "Their IT team opened the ticket" rage screaming Companies not following setup instructions. I used to provide Terraform, Powershell and Graphical setup. I can count on one hand how many people used Terraform/Powershell. This was always dicey because I got familiar with the error messages and would be "Yep, this was not setup right on their end." I had 4 phone calls with $CustomerIT swearing it was setup properly and stopped attending after that. Finally they got someone with a brain to review and finished setup. Documentation would fall out of date because of some UI change and I'd spend a day reviewing it and updating it.
- dvrp 1y agoin the real world you pay for extra security; yet developers think that this should be free just cuz…?
- zdragnar 1y ago... Because the specifications are open. Practically the whole Internet is built on open specifications. The security and operations benefits are obvious for enterprise customers. Startups could also benefit greatly from it, but the cost ramping of the large providers is onerous.
- esseph 1y agoDamnNear. Every. Customer. Needs. SSO.
- bee_rider 1y agoI don’t think you should have to pay extra for extra security in general. Making a product or service free of security defects ought to be considered a basic requirement of merchantability. But we should also draw a distinction between, like, real security defects (RCEs, that sort of thing) and features that might make it easier to deploy a system securely (SSO).
- throwup238 1y agoSome of these numbers don’t quite make sense. AppSmith has the highest percentage increase (16567%) but that’s because the minimum is 100 seats, so the actual number is $25/mo or 66% increase. How often do vendors enforce these minimums? I’ve never had a problem getting past them (at least with small to medium sized SaaS companies) when contacting sales as long as I had a few tens of users. I really appreciate Cloudflare not putting SSO behind a paid subscription because using their Cloudflare Access product with Github SSO has been the easiest way to secure my personal services running on a VM.
- arjvik 1y agoOut of curiosity, why GitHub as the SSO provider? Am thinking about local SSO for my homelab and was debating passkeys vs tying to Google accounts.
- throwup238 1y agoI don't use Google or any other SSO account except for work so my personal Github just made the most sense. It was also trivial to set up without digging through layers of UI.
- esseph 1y agoYou can always use a passkey with your Google account.
- ian-g 1y agoI don't think it's necessarily _wrong_ to say that SSO shouldn't just be an enterprise feature, but if you need to hire an additional person or two just for SSO, you should feel free to pass that cost (plus a cushion) on.
- coldcode 1y agoI once worked a contract at a public University, and the first thing I noticed was their SSO implementation. You logged into a single page, and then it called the other applications with a GET putting the username and password in the clear in the URL. Facepalm.
- supportengineer 1y agoI once worked at a company in the Healthcare space that acquired a small company for $10 million. When the deal closed and they showed us the Patient Portal, the first thing I noticed was no HTTPS. At all. Just plain HTTP everywhere.
- robertkoss 1y agoIts the same if you sell B2B software and have to offer SSO to your customers. Every auth provider like Auth0, Clerk, WorkOS etc. increases their prices tremendously if you require SSO...
- sidewndr46 1y agoThat's why single sign on is so great, every single vendor has their own way of implementing it.
- mooreds 1y agoDisclosure, I work for FusionAuth. heya robertkoss, FusionAuth is software you can run yourself for free which is comparable to Auth0, Clerk, WorkOS. We have a community plan with unlimited SSO providers (SAML and OIDC; sorry, we don't support WS-Fed). Here's the doc to set up an OIDC provider to Entra ID: https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/azure-ad-oidc https://fusionauth.io/docs/lifecycle/authenticate-users/iden... We have other things we charge for (pricing here: https://fusionauth.io/pricing?step=plan https://fusionauth.io/pricing?step=plan ) but we don't charge per SSO connection.
- mamcx 1y agoAnd then if you need multi-tenant...
- Our_Benefactors 1y agoThis page is unfortunately pure delusion. I recall early in my career, I was building out a pilot version of a service. Early feedback was that users loved it, and it looked like the tool would be a good way to build our brand, but not a huge money maker. Cost per seat would be about $15/mo and we expected to sell less than 10 seats per customer. SSO integration would be a flat one-time fee in the mid four figures, and my boss laughed when he explained there was more money to be made integrating a mediocre service than selling a perfect solution behind a traditional username and password login.
- tptacek 1y agoThis pops up on HN about once a year, and it's worth calling out that the SSO tax has mostly nothing to do with technology or with support costs and mostly everything to do with market segmentation. One of the clearest segmentation signals you get is that bigger, less price-sensitive customers all require SSO (because their SOC2 attestations require it). You can get irritated about pricing systems that soak price-insensitive customers, but remember that the big price-insensitive customers pay for the price-sensitive customers, which is why this kind of segmentation is practically universal. Previously, on this, from me: https://news.ycombinator.com/item?id=29892664 https://news.ycombinator.com/item?id=29892664
- cubefox 1y agoSimilar reason why there is a big price difference between DVDs and Blu-rays, and why DVDs still exist in the first place.
- adrr 1y agoIf I ran a saas company, i would charge more for users not use to SSO. Bigger risk storing passwords and managing login process(2FA, password reset etc).
- sparrish 1y agoIf you ran a saas, you'd know how much more supporting SSO costs and sing a different tune.
- beacon473 1y agoWhy do some sites require SSO, without an option for a local (better term?) account? I prefer to have a unique username and password for each service. KeepassXC is my SSO provider.
- baq 1y agokeepassxc is not a good SSO provider for 100 employees.
- esseph 1y agoThis is a real problem of misaligned incentives.
- ethan_smith 1y agoThis is the most security-aligned approach - storing credentials creates significant liability (breach risks, compliance requirements, password rotation policies) while offloading authentication to specialized providers reduces attack surface and improves user experience.
- neilv 1y ago> Single sign-on (SSO) is a mechanism for outsourcing the authentication for your website (or other product) to a third party identity provider, such as Google, Okta, Entra ID (Azure AD), PingFederate, etc. Or the IdP is administered by the enterprise's own IT operation. The outsourcing of your security to (and also consequently leaking information to) a third party IdP is a fairly new phenomenon in 'security'. Someone must have paid a lot of money to promote that idea.
- axus 1y agoBut I really like checking my email without signing in to a VPN.
- neilv 1y agoAn IdP doesn't have to be on a VPN, no matter who operates it.
- lmm 1y ago> Someone must have paid a lot of money to promote that idea. I doubt it. Once you notice how bad the median enterprise IT operation is at running an IdP the idea promotes itself.
- weitendorf 1y agoWhy? It is a screaming good deal for >90% of companies to take as many problems like “employee credentials can be used to access user passwords”, “we need to develop, release, operate, and support something where small mistakes introduce security breaches + hire people capable of property doing that work”, and “if someone gets this private key they can use it to impersonate any user” off their plates as they can. It’s good that Bob’s App Factory cares enough about security to hand off hard parts to Google for $X/mo if they’re not confident in their own ability to handle it better themselves. I trust Google more with my data than any other company in the world, including Bob’s. Bob’s a great guy but I doubt his IT department is reviewing every change in keycloak and preventing unilateral access to hmac keys.
- 1y ago
- jjcm 1y agoI agree with the sentiment in theory but disagree in practice. The way I typically look to segment and price things is by billing based on organizational complexity rather than gating end-user features whenever possible. If something is a specific need for a large org, it should be a higher tier, since those organizations typically have a larger ability to pay. If it's something that a single seat user would want if they were an expert, I'd rather not tier on that - it basically would be shitting on your largest segment of superusers / fans / influencers for most B2C apps. Put a different way, if I were subscribing to MS Paint, I'd rather have to pay more for SAML/SCIM provisioning than to pay for the number of particles the spray paint tool can output at once. One limits orgs, the other limits users. You should never limit users without reason.
- erikerikson 1y agoWhoever wrote this erroneously sees the entry level pricing as a viable product rather than just a part of the sales funnel for the customers that bring the bulk of buying power and revenue.
- derektank 1y agoA lot of premium or business plans don't offer SSO either. It's Enterprise or bust 9 times out 10
- naniwaduni 1y agoThe end of the sales funnel is Enterprise, yes.
- SkyPuncher 1y agoAt a past company, we had discussion about this exact topic. Despite wanting to offer SSO on a free/low-tier, we simply could not justify it. SSO was by far our most expensive feature to support. It was the single largest bucket of support requests and a significant percentage of those requests required an engineer to get on a call with a customer (and their IT team). We evaluated building better product/tooling to self-serve, but we realized that it likely wouldn’t solve the issue. SSO is security critical, so anytime things go wrong people throw their hands up and say “nope, I’m not the one that’s going to hurt my company”. They really just needed someone on our end to give them confidence. Don’t get me wrong, we fixed many of the biggest issues - but there’s an endless supply of crap that can go wrong.
- Aurornis 1y ago> SSO was by far our most expensive feature to support. It was the single largest bucket of support requests and a significant percentage of those requests required an engineer to get on a call with a customer (and their IT team). I can confirm this is how it goes. You can theorize about how SSO should be straightforward or self-serve, but in practice the SSO feature creates a disproportionately large support and engineering burden. When you’re dealing with SSO support for a customer buying 100 expensive seats it can be easy to justify. When you’re debugging the SSO for some small shop with 3 licenses who will churn suddenly the moment their lead noticed a shiny new competitor, it’s not worth it.
- lousken 1y agoSorry but that just means the feature is difficult to use on either side, so that would be at least 50% of your problem anyway. Provide good docs? How about that? Every time someone has a problem create docs for it and after some time those questions will reduce significantly. edit: also, for people implementing this the first time it should be obvious what happens when 1) they create a new account in your app (local) 2) if they create a new account within SSO provider 3) what happens with existing accounts during setup and if current users will be migrated over or not (or if they can use both singins)
- fabian2k 1y ago
- z3ratul163071 1y agothank you for this. i also found this few years back, incredibly annoying.
- sirjaz 1y agoThis is just more justification to bring software back onprem and kill SaaS.
- xtracto 1y agoYes but, most fake open source developers make also SSO a non-open add-on of their "open core" software.
- worik 1y agoThat list of firms is a wall of shame, period
- esseph 1y agoEvery shop should have SSO, period, as a security requirement. Not offering SSO outside of extremely expensive "Enterprise Plans" is actually hurting national security by segmenting access / control / auditing. It sucks. Either vendors need to offer SSO across the board on much lower plans, or the Fed Gov needs to step up and help subsidize costs for the CISA 16 identified critical infrastructure sectors.
- esseph 1y agoJust to add to this, a lot of those businesses in those industries are NOT in "IT", and have awful Operational Technology networks and security, yet their business as a chemical supplier, or shipping company, or finished materials producer, or even a small regional ISP is both "critical" to the country, and yet lucky to even have a handful of staff looking at "IT" or security. SSO tax is creating a lot of barriers and problems that it doesn't even realize. Something has to give.
- karel-3d 1y agoSSO is actually really annoying to implement well. Better cash up
- legitster 1y agoMaybe I'm missing something. Nearly every one of these companies offers SSO on their basic plans through the big public IdPs (Google, GitHub, Microsoft, etc). What's being advertised as a feature is not SSO, but SSO through a private IdP. So this could just be a case of confusion created through marketing simplification. Which, fair game! If you are big or technical enough to need a private IdP, you should probably be paying for an Enterprise plan. And from the perspective of these software companies, supporting your third-party IdP is kinda a luxury feature. Moreover, I can understand why Adobe wouldn't want to include these advanced features in their plans for college students.
- holbrad 1y agoThis comment clears things up. As setting up Google/Discord with Better Auth wasn't particularly hard for one of my home projects.
- Aeolun 1y agoThat’s bizarre. Why would you call outsourcing your user management to Google SSO? That’s a feature provided by most spam systems to authenticate you, not a serious business application.
- esseph 1y agoGoogle Workspace / Google Cloud auth
- lsb 1y agoAlso: this SSO tax is deceptively framed. Many of these services allow one to sign in through, for example, Google, which can count as a single sign on, and many organizations have a mail account, but that isn’t taken into account.
- time4tea 1y agoAny company that does this, but yaks on about 2fa/security is just gaslighting you. Sane for those that only offer 2fa as part of cost plus deal. SSO or 2fa are table stakes for companies that care about you - even at a free tier. Both are effectively zero cost to deploy (once you create the login capability for one) ...
- thomasdub 1y agoDoes anyone know of a list/can name companies that don't charge for SSO, Audit Logs[0], that have a free edition where you don't have to talk to a salesperson to evaluate etc.? [0] https://audit-logs.tax/ https://audit-logs.tax/
- keepamovin 1y agoGuilty as charged. With BrowserBox I will be adding an SSO layer. Enough people ask for it. And it's not that hard to add something basic that customers can extend.
- firesteelrain 1y agoA little confused on this jFrog Artifactory Enterprise license gets you SSO Atlassian Crowd for Self hosted gets you SSO Is this saying that you need a license to get SSO?
- est 1y agoas others have pointed out, it's not a tech issue, it's a support cost. I have developed several SSO in-house. The various providers don't always align. e.g. sometimes you get the email, sometimes you get others, sometimes you don't get anything. It's a mess. If any of those details goes wrong, your user will be locked outside of your system and vent. And there's another kind of fake-SSO. After the first time you login with SSO, the system asks for yourr phone or email again! So what's the point of SSO?
- esseph 1y agoI don't care about most of the 60 features in an Enterprise Plan for $20,000/mo or whatever, what I need is fucking SSO for the sub-100 or sub-500 count shops. Ugh
- foxbee 1y agoAt Budibase, we give away SSO for free. Putting a price on security felt wrong. https://github.com/Budibase/budibase https://github.com/Budibase/budibase