Currently using Firebase Auth, which was fairly easy to implement and is free/cheap at high user counts, so is an option for a B2C application, unlike most commercial solutions I ran across.

Cons: difficult (sometimes impossible) to customize, password complexity can't be set (6-letter passwords allowed, wtf), and worst of all - it's Google, so expect appropriate level of care from the company (read: none). Definitely planning to switch out when/if there is traction, but for an early MVP I found it to be quite decent.