Funny thing is that its powered by Auth0. Its funny that Ory is asking for the HAR file
428 karma · joined September 12, 2016
https://svdisposition.hibid.com/catalog/607470/tgi-fridays--...
Can checkout SuperTokens which is also open source and self hostable but not sure if its worth it for now.
Alternatively, you could use framework specific authentication libraries like nextjs or Devise (Ruby)
This obviously wasnt handled as well as it could have been.
On the fundamental issue of building EE features: If 100% of the code was open source, there would be less incentive for them to continue to maintain, update, upgrade the product. The EE features ensures that there is an incentive for them to continue to work on this project. Infact, the community _should_ want project maintainers to be compensated.
As someone else said, the project is open source, you can always fork and add any specific feature you want. It comes down to how useful is the actual open source project. If it is very limited in features and functioning, then yes - it is against the spirit of the open source. But if its a fully usable, functioning product (not for all but atleast some number of usecases), then it has created value which it is not capturing for itself - which is a net good for society and the industry.
Our UI is native to your website (no redirects) and the auth logic sits within your backend api layer - giving you a lot more control
This is a balanced article and I definitely agree about being clear on what constitutes competition. A few questions:
1. Does Gitlab see much competition from hyperscale providers like AWS?
2. Given that Gitlab has a thicker proprietary crust and a relatively smaller open source core (compared to hashi), is Gitlab more insulated from these types of issues?
Infisical is an open core business model. While there is a proprietary crust, the core is truly open source.
Disclaimer: I run an open core venture
This only affects people who are directly competing with hashicorp using hashicorps code. That sounds like a reasonable thing to want to prohibit.
Why should hashicorp have to spend tens of millions on product development only for a competitor to spend zero but be able to offer the same product? That sounds like a net negative for the whole industry as it disincentivizes R&D
What are you planning on using instead?
We wont have all the things you mention but will everything to do with tenant onboarding, identity management, user authentication will be out of the box. So in terms of functionality, it would be comparable to keycloak but easier to extend and integrate monitoring and billing tools.
Also I definitely understand your perspective and it makes sense. SuperTokens still is 100% open source - but you are right, as we evolve into a paid offering, there is scope for improvement
we're being used at scale of millions of monthly active companies by very large companies - which have done deep technical evaluation.
If the company dies or gets acquired (possible with companies of almost all stages), the product is actually open source. You can self host it without any permissions and we provide daily database backups
Well i think that is the only thing that matters.
If I split all auth methods into the 6 different features it really is, then it becomes 13 free features.
The ones listed as not open source is to indicate what we plan to build for our paid offering. If we removed those and 13/13 were open source, would that change your views? If yes, then that qualification is pretty important.
SAML client and OAuth client are both free. You can add auth with any OAuth 2.0 provider to SuperTokens.
Being an OAuth 'provider' (emphasis) is not open source as it is a feature you need for complex use cases.
You can add 2FA with email or SMS in the open source product too (just requires some customizations and overrides)
We've mentioned the source (if you hover) and it is based on our internal user research and conversations with users of these products. By no means is it perfect and there are many many satisfied customers of each of the other products.
Your point is taken though and maybe we will edit that point out or try to add further nuance.
I do believe however that broadly speaking, that reviews of keycloak lean towards it being relatively harder to use and maintain than Firebase. Arguably the reviews of Cognito are more mixed than "Low"
RBAC, session management and user management dashboard are open source too. Its several years of an engineering team's work that is all open source.
Our philosophy is to keep features that are broadly required by developers and small companies in the open source version. Things that large companies require, will be source available.
We have several enterprises (more than $100M raised or several hundred employees) that are using SuperTokens at the scale of millions of monthly active users - all using the open source product. We think the open source product is a sufficient alternative (for a large enough population).
Are there any other features you feel should be in the open source version? Happy to hear any feedback and improve
(Project creator here)
The only code in EE so far is the feature flags. We will implement certain "source available" features in the future
Our inference or best guess based on the above is that people were typing supertokens.com directly in the URL bar on the browser. Like you said - I would not have expected that (and still doubt it) but dont have any alternative explanations for why that would be the case.
Our agency doesnt know we've even written this. I still need to share it with them.
Depending on the answers to these questions, I would evaluate the tradeoffs of migrating. If SEO is not critical or if you already have a certain domain authority / backlinks or dont plan to continue for a long period of time - then it may not make sense to migrate.
So if PingFederate is the provider, you can add "sign in with Ping" on an app that uses SuperTokens