Hacker News new | ask | show | jobs
by tw04 846 days ago
Sure it is, this problem has been solved for a long time: SCIM. Any modern idp should support SCIM and if the app doesn’t I’d question using it at all.
2 comments

Me: "We should use SCIM, our IDP and our App both support it" PM: "No that's too complicated, we'll roll our own provisioning and never worry about de-provisioning because they won't be able to log in due to SAML anyway!"

I can't tell you how many times I've had that conversation... but I'd need at least both hands and a foot.

This is why most SSO forces you to sign in again every day. So frustrating!
SCIM adoption isn't near where it needs to be. I guess yeah, this is the correct answer. We live in a world where SSO is considered an enterprise feature, I hope one day that it's considered default.
Shameless plug for my startup (hope that's ok!)

If you're building an app and need to add SCIM, check out WorkOS. My email is in my profile to chat.

More info -> https://workos.com/directory-sync

$125 per connection / month and then you wonder why companies don't offer SSO/SCIM by default in their free/cheap plans.
(I work for a competitor in the same space as grinich.)

Charging for scim is a convenient way to segment customers, the same way SLAs are. For companies that care deeply about controlling user access (or are forced to by law or regulator), that isn't much money.

Features like this subsidize the free/cheap version, which you can then offer to let folks learn about and love your software, and use. After all, you can replace scim with careful manual processes until you get to a certain size.

It's similar to the sso tax: https://sso.tax/

I'm not aware of a scim.tax site, but maybe there should be one? :)

> Charging for scim is a convenient way to segment customers

It’s also a convenient way to keep charging non-SCIM customers for unused licenses when they inevitably forget to manually nuke accounts belonging to leavers.

Agreed. And most apps have it locked to the most expensive level.

Slack, to their credit, offers this at the business+ tier: https://api.slack.com/admins/scim