mathiasn

Is that something you want to open source?

https://ssotax.org gets more updates. There is also a Friends of SSO page :-)

What are other potential platforms?

Or better ssotax.org which is already way ahead.

Yeah that's the old not very much up2date page. https://ssotax.org has more data and even has a Friends of SSO page.

Depending on the point of view it can also be a strength. Actually many of our customers like that we're in Slack because their people are already there:

- no login required to request an access - they don't need to "learn a new application"

So for end users that's great. There is still a web app for admins with more details.

But I can see where you're coming from. We plan to offer an alternative to Slack to be independent if the customers want that.

Slack is required for AccessOwl. It's used for things like approval workflows, task management and notifications in general.

What do you use instead?

From a legal point of view that might be true, but I believe people are not aware that this is a problem. They just register, check the "Agree terms of service" box and do whatever they want to do. I saw that often, especially with Marketing.

Which makes it even worse because you cannot detect that then :/

Shouldn't people just be able to try out new things? How can a company be innovative otherwise? And at a specific point (e.g. putting customer data into it), they need to start a proper vendor assessment process.

Have you seen Livebook? Best Jupyter Notebook ever!! https://livebook.dev/

or even better https://ssotax.org

BTW: https://ssotax.org is more up2date

It's a community project, you can just update it :-)

There is a better ssotax.org which is more up2date and has even a Friends of SSO page.

Yes, that's what I heard too. I mean they still have SCIM which allows you create/remove user accounts via API. Although that's still security relevant, giving at least SSO out for free would help already. Still, I would prefer something that does not relate to security.

What do you mean with Docker? I saw on their page that they offer SSO on the highest tier, so they do not look solely on ARR then?!

Hmm audit compliance? Google gives you a log of who logged in where, doesn't it? And with "proper RBAC" you mean that you can put somebody into the "Developer" role, hence he gets AWS, GCP, Datadog, right?

Oh yeah, that's indeed a step back when you compare it like this. Especially today, automation should be possible everywhere. There is no real reason for that. SaaS apps could just stop blocking that and everyone would be happy. Some just need to start...

Did you also consider building it with Elixir and LiveView?

Indeed, that became a bad practice... Zoom, Calendly just to name a few do that. That's so stupid and just not customer-friendly at all. Whenever I see this, I start searching for an alternative... But there are also role models in the market like Slack that prorate even based on days after a user was deactivated. And they even remove users from billing when there were inactive for a longer period. Very kind :-)

Oh yeah, Elixir is just amazing <3. We use it for our commercial platform accessowl.io. Parts of OpenOwl are originated from there. It was the fastest way to push OpenOwl out. Moreover doing it like this allows us to use OpenOwl as library there.

But yeah I was thinking longer about it as Playwright is pretty good for scraping/RPA and works best with Node. One (expected) limitation is that we cannot easily open a browser window to let the user enter a OTP or solve a captcha as we encapsulated everything into Docker. Not sure how we can solve it yet...

You don't need to upload your 2FA tokens somewhere. Everything runs on your local machine. You can do whatever you want there.

Typically only companies above a certain size use SSO systems, and even larger ones require it for everything.

I believe it's historically grown but it's not true anymore. More companies would use it if they could as this makes your processes way more automated, easier and more secure. Also more companies take security seriously (i.e. more and more companies get ISO27001/SOC2 compliant) but just can't afford the Enterprise prices.

Fantastic feedback. Indeed these are distinctive problems. For instance, "SSO is expensive" seems to be the root cause for the "centrally manage permissions" and "automatic account provisioning/deprovisioning" problems. At least when we're not talking about enterprises.

OpenOwl tries to give transparency over the user permission data in your SaaS tools - independent whether you have SCIM APIs or not. It's read-only though. No automatic account provisioning here.

However, as some of these problems are very close to each other, it could make sense to solve them together. But that's not the intent for OpenOwl.

That's a good point. Indeed there is a technical focus on login flows at the moment as this seems like the hardest problem to solve. Adding API key flows makes definitely sense though!

Sure, feel free to raise a GitHub issue, happy to discuss.

I really hope that companies stop putting SSO/SCIM into a separate plan but allow using it in lower plans.

Thanks for the idea. That makes sense. We hope that more recipes can be added soon so that there is more coverage for everyone.

Historically grown indeed ;-) It's fine to segment the market with a separate enterprise plan, I agree! I believe "keeping security hostage" by only allowing it for way too high prices (multiple of previous tier) is not right though.

Oh thanks a lot. I updated the repo description. You're right with what you think though :-)

That's great advice actually. Thanks a lot for your open words, appreciate it!

Hmm not at all. But isn't it just another persistence storage? I mean yes, it's a column instead of row-oriented one. But essentially it saves data.

The core problem I want to solve is basically getting data from various SaaS tools. Alone getting the data is a big challenge especially when it's usually not available in the right form or the API is not accessible. Another one is then consolidating data of several tools with complete different data models.