Cost to companies of single sign on/oauth

[titch]

Just wondering if anyone has any idea how much it costs companies in dev/time/licencing? to set up oauth. Getting really miffed with lots of big names still wanting manual creation of accounts and another username and password for kids to remember. Is there a big cost involved in setting these up for smaller companies? If not I'm tempted to start sending out "buck your ideas up or were leaving" emails.

 

I would like to proven wrong that lots of these companies aren't just dragging their heels!

[FishCustard]

No licensing for SAML2, it's all open source. Integration isn't too hard either, I've written SAML SSO modules for applications by myself in a week or two.

[localzuk]

It's pretty easy to implement. Pretty much all modern languages that you'd create websites with have oauth2 libraries ready to use.

 

I'm developing a dotNET core web app for something internally in our Trust at the moment. Took me a day to implement users, user roles and Google sith integration. Adding other oauth providers is a small task also, with the library supporting a long list of providers out of the box. If I wanted to pre-populate users from our AD or SIMS, that'd be a few hours work on top, not a lot.

 

The issue is usually a mix of lack of knowledge and a lack of will by suppliers, rather than simply not wanting to add it.

[titch]

It's a shame. I'd happily pay a bit more for the functionality. Maybe need speak with our feet!

 

Maybe time to start lobbying a few of these companies in a nice way.

[jmak]

I sometimes wonder if it's a conscious choice in the hope that you're less likely to change providers if you know you have to go through the pain of setting up and managing another load of user accounts.

 

No real excuse nowadays. There are 3rd parties that can cover most web based services if you don't have the time or knowledge to do it in house: RM Unify and Airhead come to mind.

[HPlum78]

I deal with this for around ~40 such applications, it's not as easy to say vote with your feet as the others in the market place also don't have a solution for user management from an embellished claim. But in saying that all the ones that do not, do support some other way of sending identity information and this is taken care of by other means of integrations (ftp, API, to name a couple) these also come in a few flavours as well those that will mange delta updates and those that will not (full load). All this does is make more work for us but that's what we get paid the big bucks for! A day in IT Services is like a day on the farm. Every meal a banquet, every pay check a fortune. I love IT Services. :-)

[dhicks]

Just wondering if anyone has any idea how much it costs companies in dev/time/licencing?

 

This thread just turned up on Hacker News:

 

https://news.ycombinator.com/item?id=23080240

 

From the comments, it would seem that dealing with (and tracking changes to) multiple OAuth providers is a pain. However, in the education world / market, just handling Google, Microsoft and Apple logins should cover a large number of schools.

 

Authentication is, of course, different from authorisation - just knowing that [email protected] is a valid user doesn't give you much indication of what they are authorised to do - are they a pupil, or teacher, what yeargroup they are in, etc. Interestingly, for schools in particular, many schools number their accounts by yeargroup ([email protected]). If you can match that naming scheme with a regular expression of some kind you can potentially do authorisation simply by username, no additional data needed.

[DrCheese]

It does annoy me whenever I get a request to setup That staff want to use and it doesn't support OAuth - As I know 99% of the issues we'll get with it will be lost usernames & passwords - Or adding new starters later in the year. Yuck.

 

I've queried some in the past (Pearson Activelearn spring to mind) and they just don't want to know. "Our system is better" - No it's not. Stop.

Others (Clickview) did it really early and our use of it is higher than it would be with a separate login system, as users don't even have to think half the time.

 

With the protection & user login info we get via Azure AD my life is a million times easier than before - You'd think companies would jumping at the chance to benefit from that security & ease of use but alas.

Edited May 5, 2020 by DrCheese

[HPlum78]

Not sure of Activelearn but Clickview supports SAML (or better put did when I set it up)

[dmj]

The problem with OAuth is (unlike SAML) is that it doesn't release user attributes, so it can be quite limited (great for API's though).

OpenID Connect (OIDC) is essentially SAML (which releases user attributes) but rewritten with OAuth2. This is where companies *should* be going best of both worlds.

OIDC FTW.

[dmj]

From the comments, it would seem that dealing with (and tracking changes to) multiple OAuth providers is a pain. However, in the education world / market, just handling Google, Microsoft and Apple logins should cover a large number of schools.

...and it turns out that there is also the UK Access Management Federation ( mostly used by Universities, but is also open to Schools and Colleges). Their job is to manage educational resources so that there is zero configuration for the end user (The educational establishment or Identity Providers). The idea is that resource/service providers sign up and are properly vetted. The service providers submit their security details to the UKAMF and they distribute them to the educational establishment (identity providers). AFAIK they have around 1100 services available. I believe there is a cost but they provide support and training.

https://www.ukfederation.org.uk/

[DrCheese]

Not sure of Activelearn but Clickview supports SAML (or better put did when I set it up)

 

Yarp they do & our usage of it is higher because staff/students can just click through to it without even thinking. Additionally, I can apply my usual conditional access rules to it (i.e Blocked from certain countries/MFA) It's a win win.

[chaplic]

Localzuk nailed it with the 'lack of knowledge' statement. Even with organisations that support it!

 

But that said I've probably done > 100 integrations in the last year or 2 with SAML and similar. its ludicrously easy with Azure AD too. I did one a couple of weeks ago where the provided deliberately didn't offer and username and password solution of their own.

 

Its a win-win setup. if they don't offer it, that's qualifying it out for me. Are you really organised enough to cancel leaver accounts?

[HPlum78]

It's lazy if you have got the skills to write some of the software that we use and then not supply a modern way to manage identities and sign ins within that software there is no excuse.

[dhicks]

Localzuk nailed it with the 'lack of knowledge' statement.

 

Just reading some of that Hacker News thread, it's interesting to see there seems to be a fair bit of a disconnect between the set of people generally developing features (silicon valley types who work for venture-backed companies) and people in corporate / educational institutions, like us, who have an idea what kind of features would be most useful.

 

I rather get the impression there's a huge un-tapped market there for applications with better authentication integration - I think there's plenty of companies missing out on user sign-ups / retention because integration with a company's logins is just too much trouble to manage. Actually, I reckon the failure point is going to be after a few users have signed up with personal test accounts, then ask for the application to be purchased for the whole company, which maybe even gets purchased for a year or whatever, then dropped as they've found that too few people have used the service because they all forgot their new username / password. OAuth support strikes me as something that should really help with customer retention - no need for IT to have to manage accounts and do password resets, no extra work, login just works and your users don't have to think about it.

[jmak]

Definitely this ^^^

 

First thing I check when it comes to renewal time is how many people have logged in. If it's another password, people don't bother.

[dhicks]

Just wondering if anyone has any idea how much it costs companies in dev/time/licencing?

 

Turns out you'd have had an issue yesterday if you were using Facebook's SDK:

 

https://it.slashdot.org/story/20/05/07/2138212/how-a-facebook-bug-took-down-your-favorite-ios-apps

 

To summarise the article: Facebook made a change to their API / SDK and many apps' logins stopped working. To be fair, the issue was fixed in a couple of hours - for the most part the process works well.