Hacker News Reader

Comment by gumballindie | Hacker News Reader

Okta is so lame no wonder is so popular among corporate mediocrity.

As far as SaaS SSO providers go, I think they're pretty cool. But all the breach related news lately has me wondering what the best alternatives are. You sound like you would have opinions.

Out of interest - what makes you say this? I'm not disagreeing, just want to understand the general (and seemingly commonly held) belief that they suck.

They have lots of ready to go connectors which makes it easy to integrate lots of apps instead of figuring out all the SAML settings... but any SAML provider will work as long as you can map the right fields. But people like easy things and Okta makes it easy. Many apps who don't have a connector will have docs on how to set things up with Okta, for others you'll have to take the Okta instructions and figure out what that means for an alternate provider. There are other things like counter-signatures which may be easier to do with Okta but also possible with others, if you have the right docs.

I'm a bit confused, this seems like a list of pros or at least neutral things?

People use them because they are easy to use, on the other hand their security issues over the past few years could make clients consider alternatives.

Thank you.

Ok another question - where do you see Cerby fitting into that mix?

What is your preferred alternative?

Out of interest, why would you not just use the directory services that you get bundled with google workspace, azureAD (Now: Entra) or freeipa/keycloak?

All of these support oauth2 and SAML, and dynamic groups for less than the cost of each and okta (it seems to be the case everywhere I have seen okta used, another of the above providers is used additionally).

I kind of wondered the same thing the last time they were hacked... someone answered with this:

"Okta: comprehensive scim allowing your IT instead of random application admins throughout your company to manage user provisioning / deprovisioning. Start pages that don't require users to remember urls but instead show them a list of applications they can use. Adaptive MFA with IT-administered settings (though Google's super-enterprisey solutions may have sth here.)"

https://news.ycombinator.com/item?id=37995670

Personally, I just go with the Google Workspace and call it a day. Start page is one of those nice to have, but not required features in my book.

If you have AzureAD you don’t typically also have Okta. Also the features you listed are like 20% of Okta’s functionality here.

If you have office licenses you have AzureAD. Lots of places have office licenses for all of or most of their employees and still have Okta.

AzureAD licenses near the feature equivalent of Okta are much more expensive than base office licenses that only give you access to the office apps and cloud storage.

Reply on news.ycombinator.com