This is how the likes of Slack, Postman sells, “Hey, 96% of your developers/team are already using it. It makes sense to buy it.”
It sounds like a trivial question to answer, but it just exposes the level of detachment that exists between who makes the purchase decisions and its users in SME context.
etc. There's a laundry list of features enterprises care about, better spelled out in the sibling post.
You really have to know who you are talking to and their motivations before you know what the right sales angle is.
One of them put in a bid to Cisco and got a reply back saying something like they were working on it but having some issues with the birds.
There’s a reason they all do it, and it’s because SSO is one of the few features enterprises are almost universally willing to pay for.
There's a number of ways for open source software stacks to make money, but I agree that finding features that companies with money will pay for is a great one.
I think Patio11 said it once, but SSO feels now like HTTPS felt in 2015. Used to be super expensive, but now should be "table stakes".
Other ways open source companies can make money:
- hosting (offers that sweet sweet recurring revenue)
- support (especially SLAs, which pair nicely with hosting)
- other enterprisey features, such as integrating with enterprisey tools (DataDog, SIEM tools)
- other auth features like fine grained authorization (RBAC, ABAC, PBAC) and provisioning (SCIM)
- control planes (I see this with tools like Cerbos and Permit which both offer fine grained authorization execution engines that are free, but charge for the control plane)
- certifications (SOC2, FIPS, HIPAA, PCI). this might not make sense in all cases, it does depend on the tool
- custom feature development (better if this is pulling forward planned development rather than something unplanned)
It's not easy, though.
I wrote more on my personal blog about freemium[0] and open-source[1] business models.
The company I work for is in the middle - anything where SSO is gated behind "Enterprise" is not even considered by us. We don't need 90% of the other "features" under the Enterprise plans, and most aren't willing to custom quote us for Basic+SSO.
Withhold it from free versions, sure - but definitely don't lock SSO only behind the most expensive option.
You can have user limits on the non-enterprise plans (Microsoft does this, for example, with Business Premium locked at 300 users or less), or gate other features behind enterprise: Have MFA across the board, but lock conditional access behind enterprise, lock more advanced audit logs & reporting behind enterprise, lock RBAC behind enterprise, or data residency, custom security policies, API limits, etc.
There are numerous other features that are non-negotiable for enterprises to help funnel them into the enterprise plan, while still being able to service medium companies with SSO.
Maybe in 2015 it was an outlier, but SSO is now a non-negotiable and with many of these businesses on M365 business premium, which includes EntraID P2, SSO is now accessible to a large number of companies where it wasn't before. It's no longer some niche enterprise only functionality, it's a bare minimum for business SaaS.
And if you’re trying to negotiate custom, non standard licensing when you’ve only got 300 employees you will likely be a noisy customer in perpetuity.
No offense, that’s just how I’m betting 99% of folks read your response.
Also, anyone who's dealt with SAML knows it's like licking lead-based paint. It's the knowledge equivalent of antimatter, every line of code you write costing you a point of IQ.
SSO has to bring in monthly recurring revenue, to cover the monthly recurring disability payments to the many people who've lost the ability to feed and dress themselves after reading too much of the xml-dsig spec.
> "Decouple your security features from your value-added services...If your SSO support is a 10% price hike, you’re not on this list. But these percentage increases are not maintenance costs, they’re revenue generation because you know your customers have no good options."
It is getting better with Entra P2 or Okta as it is couple of minutes to configure if you use good framework in your projects.
But the tax was because of what I wrote about in first place.
Some "green" IDP like O365 OIDC, Okta, Entra and such are usually included without extra cost (and will be self-service soon, too). Some "yellow" - usually SAML - IDPs come at a fixed fee. We know them, we know they are weird, but we can deal with it.
Other things are flagged as red and call in hourly billed projects and recurring maintenance fees. Like, one customer has an in-house developed SAML IDP written in PHP a decade ago or so. I want our customers to use SSO, but that's a level of jank I'm not supporting for free.
Coursera: $399 per u/y -> $49875 per year [7], 12400%
So, I check out the footnote:
[7] Coursera requires a minimum of 125 users to access SSO pricing. As they do not have an Enterprise price listed, this price just scales their lower cost tier up to 125 seats.
Dividing by 125 shows the SSO pricing is $399, so exactly the same as the non-SSO pricing. I fail to see how this is an SSO tax.
It might be that there is an SSO tax as the Enterprise price wasn't available to them, but listing it as 12400% increase seems like a deliberate attempt at deception.
I've used to work in small startup with ~10 people. The owner was always happy to pay for tools to developer productivity. We did not subscribe to Coursera, but in the theoretical case we'd all want to, the pricing would be:
10 users, no SSO: $3999/year
10 users, with SSO: $49875/year
It's an SSO tax, and a super hefty too. We'd probably balk at it and chose the less-secure option instead. And the fact that we'd get extra 116 licenses we had no need for is absolutely irrelevant, there is nothing we can do with it at all.
My point was that saying the minimum order is 125 seats for enterprise, and so claiming that the price for a single seat is increase by 12400% is being deceptive.
If you buy a six-pack of beer, you don't say "This is terrible! I only wanted one beer and this six-pack is a 500% increase in price!". If you only want one beer, you just buy the single beer and leave the six-pack on the shelf.
Imagine you _really_ wanted to try Foobar beer. So you get to beer distributor, and you find out that while each bottle is just $5, the minimum order is a crate of 144 bottles and they give no samples.
In this case, you might say: "Yeah, I really wanted to try that beer but there is no way I am paying $720 for that". It's exactly the same here.
(re 1147% vs 12400% - sure, maybe you could argue you should not look at a single license, but rather at a pack of 5 or 10 licenses... but this does not change numbers much for Coursera, it's still huge increase.)
Even if the original elastic company offers it cheaper, or better, that's a massive hill to climb. Corporations don't care about costs, they care about pieces of paper, or less charitably nice dinners with the sales team.
That by itself is worth the extra cost for some organizations. While I’m a big fan of AWS as a technology provider and have been heavily in the ecosystem for 8 years, I’m no fan of the company or the organization as a former employee.