Hacker News Reader

Comment by andrewguenther | Hacker News Reader

I beg of you, please reconsider the SSO tax (https://sso.tax/). This is becoming a big pain point for small orgs trying to become compliant that a small change like this can be huge in decision making. If I look at Pipedream, Airplane, Temporal, and Retool none of them will even list pricing if I need SSO, I'm suddenly a 40 person company with "Enterprise" needs. If you want an easy differentiator, including SSO in your Team tier is a simple way to do that.

View on HN

The reason a lot of companies charge extra for SSO is because it is a support nightmare. Most users can't tell the difference between "my SSO provider is broken" and "your service is broken" so they always blame the service, who now has to either tell the customer "talk to your SSO provider", which of course they don't like, or having to diagnose and fix SSO problems.

I agree that it should be a core feature, but I sympathize with companies that need to charge extra for it.

(Small plug for my startup, hope that's ok :))

WorkOS makes adding SAML to your app incredibly easy and fast. We're powering Vercel, Planetscale, Webflow, Loom, and hundreds of others. Pricing is transparent and scales as you grow. And you don't need to talk to a sales rep. ;)

https://workos.com/single-sign-on

Great product.

What? That's such absolute nonsense. Compared to managing your users passwords? Bah! No way is supporting saml that hard. It's. Library, and config. Users usually find out pretty quick when thier idp is down.

Plugging in my startup BoxyHQ here. This is the reason why we open sourced our SAML integration - https://github.com/boxyhq/jackson, it should be commodity.

Isn't this true for just about any integration in a product?

Yes, but SSO is a very upfront integration that blocks all access to app. Most other integrations only break a piece of the app or are in the background. And lots of companies charge extra for those integrations too.

I find this hard to believe, setting up SSO was a piece of cake with Github. Sure you have some issues during the setup, but once it’s there it never changes.

Then again, Github also chargea you $20/month instead of $4/month if you want SSO in a small org, but it’s possible.

If I as a SaaS provider get my SSO SAML integration via a provider like Okta or Auth0, the auth provider pricing itself is also on a "call us" tier, with a per-federation pricing in the low four figures for each individual company connecting to me via SAML.

It's pretty insane, so I'll state it again: To have a company connect to my SaaS via SAML, I as the SaaS provider have to pay my auth provider $X,000 per year for the privilege. Not counting the base enterprise tier pricing for the auth solution itself. So then I have to roll my own solution if I want to provide it for free, and I get the joy of supporting the long tail of broken SAML implementations on both the service and identity provider sides. For free. In a perfect world SSO wouldn't be a shitshow and everyone could have it for free, unfortunately that is not this world.

The SAML world is definitely a fun mess. We’re[1] building out SAML support and are beta testing it with a few customers and it is funny how different even the large IDPs are. Add in things like needing to test the integration, making sure attribute and role mappings are correct, and it’s unfortunate but understandable that companies not specializing in auth wouldn’t want to deal with it except for customers that pay a lot.

[1] Disclaimer, I’m a founder of PropelAuth

Plugging in my startup BoxyHQ here. This is the reason why we open sourced our SAML integration - https://github.com/boxyhq/jackson, it should be commodity.

Fwiw, Amazon offers an sso platform with saml for free. That's not the answer for everyone though, and may not be for you even. Just putting it out there for those looking for a cheap saml identity provider.

I don't disagree with what you are saying. It's just that everything is already free and as friction-less as possible. I made a point to remove any lock-in. My goal is to make Windmill fully-featured and available to the widest range of people. On the other hand, we do need to make some money at some point. We could have an "enterprise edition" with features that are proprietary. This is what most open-source companies do, but it would create misaligned incentives to not bake those into the product and make the product worse. If I am being honest I will probably bake SSO into the team-tier as soon as we have some healthy financials :)

From my limited knowledge of how SSO works, is this possible?

1. A company Acme wants to have SSO in the tools A, B and C that it uses.

2. Another company Balloon integrates with A, B, C to use the admin API for an admin account to modify or delete users in that account

3. Acme logs in to Balloon and connects its admin account of A, B, and C to these integrations.

4. Now Acme has access to employee's accounts in A, B, C through the Balloon's dashboard to modify or delete users etc.

Yes, it’s typically referred to as SCIM and is supported by most serious SSO services.

I was not aware of this and will look it up. I was of the naive opinion of the parent thread.

I wish this website had a wall of fame on it as well

Reply on news.ycombinator.com