[lelanthran]

> Security is not a differentiation method. It's table stakes for any technical product.

Security as table stakes, sure. SSO, certainly not.

It's an additional cost, last I checked it was between 10$ and 20$ per user per month if you take the cheapest option and outsource it.

This whole notion of "Unless you meet this security standard that 99% of products don't meet, your product hasn't met table stakes" is nonsense and needs to die.

SSO will get cheaper in the future; for now it's hard for a product development team to justify getting 0$ in revenue just because of some purity test by irrelevant folk on the internet.

[anilgulecha]

We will have to agree to disagree on whether SSO is security or not.

[lelanthran]

> We will have to agree to disagree on whether SSO is security or not.

It's not a binary flag, it's a spectrum. "Defense in depth" is a thing, and that means a layered approach to security.

Just because a product is missing SSO does not in any way mean that that product fails any security check.

IMO, holding the position that not having SSO is the same as not having security is unreasonable.

Missing SSO does not magically make the other $FOO layers of your security vanish into the ether.

[rad_gruchalski]

Running my own keycloak or another ory hydra is a boring task. Locking SSO behind some arbitrary scale and raked up price takes sales away from you. It’s a matter of perspective.

[lelanthran]

> Running my own keycloak or another ory hydra is a boring task.

Simply running keycloak is not sufficient for SSO.

An SSO implementation may take months of dev time (i.e. $50k, minimum, considering cost of dev hours spent on it, and opportunity cost of not having those devs putting those hours into features).

And after you have done that, it remains an expensive feature - it's a high-touch feature that will eat product support time like you wouldn't believe.

Outsourcing this is still the cheapest option, and it still costs more than the product itself in many cases.

[rad_gruchalski]

I don’t understand your point. My question is: if the service provider offers SSO as an additional feature, why limit it to certain size of a client? Their service supports it. Why cannot my two persons company enable this feature? My two persons company can run my own keycloak and use it as an OAuth provider in your product all right. If you need months of dev time to enable SSO on my account then say that upfront because I will certainly find a different service provider because you clearly don’t know what you’re doing.

[lelanthran]

> If you need months of dev time to enable SSO on my account then say that upfront because I will certainly find a different service provider because you clearly don’t know what you’re doing.

If you could do that, you would. The point is that SSO is high-touch and high-maintenance, and the price reflects that.

If it is as cheap you appear to think so, you'll make a killing offering SSO for businesses and undercutting the current providers by (maybe) 50%.

I don't think you are doing that. Maybe I am wrong, but if you are right you're leaving easy money on the table.