Ask HN: Which Auth Service for SaaS?

6 pointsbert20023y ago9 comments

How did you decided which authentication service you use for your Saas? Built in or external service provider?

9 comments

It depends on what your needs are. If you need simple auth for a single application, most languages have libraries/frameworks that cover most of your needs and are relatively trivial to implement. In .NET land you have Identity[0] for example. You just need to look up what is the most popular option for the tech you're using and if it ticks all your boxes.

If you're looking for a full fledged service that offers SSO and that you can self host (or cloud) with SDKs for most of the popular languages out there, then I'd recommend to look at Ory[1].

[0] https://docs.microsoft.com/en-us/aspnet/core/security/authen... [1] https://www.ory.sh/

bert2002OP3y ago

The problem with simple auth is that it gets complicated with TOTP/2FA which I believe is necessary nowadays. I think you are right so see what is most popular with the language (python in my case) and stick to it, but there are lots of Identity providers our there and they have different pricing schemes. I will definitely check out ory.sh I have not heard of them before.

whichdan3y ago

If you're just building an MVP I think doing "magic link" auth is underrated. It's super easy to set up, relatively secure, doesn't need any of the complexity of passwords/sso, and is easy to migrate to a different system in the future.

Auth0 is complete overkill if you don't need their advanced features IMO.

bert2002OP3y ago

I really like magic link + 2FA which gives a bit more security.

satya713y ago

Auth is zero value-add table-stakes requirement with a lot of complexity. I haven't a seen a product with enough built-in. External provider is the way to go.

bert2002OP3y ago

I tend to agree, but which provider do you use?

satya713y ago

Depends on features and budget. AWS Cognito is very cheap, but not many features out of the box. Google Cloud Identity Platform seems to be same category as Cognito with some differences. Auth0 is a little more expensive, but has a lot of features. There are others like Ory, KeyCloak, etc.

iamandras3y ago

I prefer auth0. It's simple enough for a simple SaaS.

bert2002OP3y ago

it seems quite pricey for a vendor lock in option or not?

j / k navigate · click thread line to collapse

9 comments

keraf3y ago

If you're looking for a full fledged service that offers SSO and that you can self host (or cloud) with SDKs for most of the popular languages out there, then I'd recommend to look at Ory[1].

[0] https://docs.microsoft.com/en-us/aspnet/core/security/authen... [1] https://www.ory.sh/

bert2002OP3y ago

whichdan3y ago

Auth0 is complete overkill if you don't need their advanced features IMO.

bert2002OP3y ago

I really like magic link + 2FA which gives a bit more security.

satya713y ago

Auth is zero value-add table-stakes requirement with a lot of complexity. I haven't a seen a product with enough built-in. External provider is the way to go.

bert2002OP3y ago

I tend to agree, but which provider do you use?

satya713y ago

iamandras3y ago

I prefer auth0. It's simple enough for a simple SaaS.

bert2002OP3y ago

it seems quite pricey for a vendor lock in option or not?

j / k navigate · click thread line to collapse