[lmarschk]

PayloadCMS is looking really nice for us. However, for us a as a small non-profit organization with ~100 people having access to our systems the missing SSO feature (enterprise only) is really a blocker.

I understand what the idea is to make SSO an enterprise feature but I really think this hurts security for small and medium sized organizations as well (not only with this project, as this is a common pattern in my experience).

[sneek_]

Hey there - small to medium orgs can use one of the available community, open source SSO plugins, with the only caveat that they are not officially supported by Payload. Or you could build your own!

Question - does the word "enterprise" make you think that the amount we charge would make it unfeasible for your org to pay to use Payload?

I don't think it's ideal that we hide all our "premium" features behind the word "enterprise" and have been thinking of alternative words / messaging to describe that.

[lmarschk]

Hey, in my opinion it is fair to have some features behind a paywall for an open core model (although I am not a fan of it, but I really understand the reasons).

But personally, I think having core security features (which I believe SSO is, e.g. also for small orgs) behind such paywall is not really helping the product.

Using a free plugin developed independently from the core product does incur other issues e.g. during updates etc. Also, it does present an additional hurdle for all non-enterprise users to make use of the, typically, more secure SSO solution they might already use leading to - in my opinion - more unsafe deployments of Payload (or any other product). It is also not helping to overcome the cybersecurity poverty line anytime soon.

When I am deciding whether to buy the enterprise version of a product, for me a main concern is whether I would also be able to use the product with its core features without any subscription (preventing vendor lock-in, in worst case I would be able to run the product on my own for a specified period of time). This wouldn't be the case if no user can login any more ^^

One last aspect: We as an organization also provided and extended SSO implementations in various products in the last years. But we only do this if the SSO code is free software. In our experience SSO implementations are way better if they can be improved by the community.

[sneek_]

Fair. Good feedback. For what it's worth, we are actively looking at our licensing model trying to make it easier for situations exactly like yours.

Might have some updates for you soon.

[synergy20]

yes making it working for all basic needs is the key to expand into a huge user space, from where you can find paid users much easier.

or it probably won't fly, there are also still many options.