from Hacker News

Ask HN: A good way to support SSO in bootstrapped SaaS?

by gary__ on 7/2/19, 6:45 PM with 6 comments

I'm looking for an identity solution that allows me to offer SSO in a typical SAAS scenario:

-Multitenant support where tenants can be created in an automated fashion

-Allows SSO to be setup back to a tenant's own identity provider (saml2)

-There could be between 2 and 300 users per tenant. I'd be happy to have 3 tenants with 20 users each to begin with.

-No real need for logins to link to multiple tenants

Auth0 is expensive for this relative to where I am at. I'm on the .net core stack where identityserver4 is often used, but some of the (java) based offerings appear to come with more out of the box (for free). In saying that, integration with SAAS of this nature looks to complicate things. So I'd appreciate any advice from HN's experience on the options available.

  • by quickthrower2 on 7/2/19, 7:40 PM

    I rolled my own at work based on https://github.com/displayr/AspNetSaml which I forked from https://github.com/jitbit/AspNetSaml

    There is a PR to make it work with .NET core at the moment.

    Once you understand the protocol it’s a case of storing some fields relating to the IdP in your database, for each tenant. Redirect to the IdP website and they’ll redirect back to you and post a signed XML doc to daub Joe is authenticated and belongs to these groups.

  • by mariushn on 7/2/19, 7:26 PM

    Unless I'm misunderstanding your needs, why wouldn't http://www.passportjs.org/ work? I've used it successfully for Google & Facebook signup/signin.

    It has SAML support and I guess one of these packages could be customized to your needs? http://www.passportjs.org/packages/

  • by dmarlow on 7/3/19, 7:34 PM

    I highly recommend ComponentSpace SAML SSO. There is a cost, but well worth it, imo. It's well maintained, support and forum available, fast responses, etc. I tried a few OSS, but they had some limitations that I couldn't get around in a short timeframe.

  • by avitzurel on 7/3/19, 6:39 AM

    Used Auth0 before with great success. They support SSO and everything you need.

    [edit] The right name this time