Hacker News Reader

Comment by SomeHacker44 | Hacker News Reader

I recently built an app that outsourced the entirety of the account creation, email validation, MFA and authorization to AWS Cognito and AWS ELB. All I have to do is verify a signed JWT passed in by a header by the ALB (and configure all that stuff and automate it into CloudFormation).

Never building this infrastructure again. What a huge time saver.

My company used Okta. We ended up cancelling it as it did not seem to offer any value whatsoever and was crazy expensive for our 300-odd users.

View on HN

Is that architecture helpful for a saas app that needs to support users from corporate customers using single sign-on via an OIDC or SAML provider like Azure AD or ADFS?

I looked into using Okta or Auth0 for this sort of setup, but both were prohibitively expensive for a saas app.

FusionAuth is free. Less pain, more awesome! ;)

And it integrates with AAD and ADFS.

We integrated one third party provider into our AWS Cognito as a test - Google. The idea was to allow many and myriad third party providers to integrate with it, and we wouldn't have to bother to do any of the integration: just configure the Cognito and the other sides, and our app logic does not have to care (but can get that info from the JWT payload if it cares).

> We ended up cancelling it as it did not seem to offer any value whatsoever and was crazy expensive for our 300-odd users.

When you canceled Okta, did you build it in house, or was the AWS Cognito / AWS solution the replacement?

Did you look at anything on-prem like Keycloak or FusionAuth?

We had a great time with Keycloak, using it as an OpenID Connect provider. I haven't tried the social identity federation or Active Directory Federation either.

We did not replace Okta with anything whatsoever.

When I skimmed the cognito docs a bit ago I saw them talk almost exclusively about using it to control access to AWS resources. Would you recommend it for general web app auth as well?

Edit: typo

Okta is free for up to 1000 monthly unique users, not sure why it's expensive, just looked at developer.okta.com/pricing

We were paying around $100/user/year for our around 300 users.

Try asking for an SLA or any feature development or 24/7 support. You'll see why people think Okta and Auth0 are expensive. ;)

Reply on news.ycombinator.com