The problem with SSO isn't technical, but that most SaaS products I've seen only support SSO for their enterprise tiers.
Otherwise, thanks to many providers like Okta and others, SSO should really be a feature provided to smaller tiers nowadays.
We're a small business (2 founders, 3 contractors), and we'd love to use SSO for everything. But we're too small to afford enterprise tiers for things like Slack, Gitlab, etc.
Hopefully this trickles down eventually.
Update: I'd like to add that we provide a SaaS product as well, and have considered adding SSO to the enterprise tier but after much research we can't really find a good reason to restrict it (apart from "everyone else is doing it", and potential manual config).
But both SAML and OpenID connect have discovery protocols. Again, this CAN technically be self-configured by the right customer. But then, maybe the solution is to have a one-time config fee, rather than require a certain tier.
> most SaaS products I've seen only support SSO for their enterprise tiers.
Lower tiers of SaaS products are more-or-less strictly designed for:
- individuals or very small businesses where everyone is friends
- who don't have exacting requirements/audit/traceability/reporting concerns
- who are willing to accept some pain/inconvenience if they use it outside of its design parameters
Credential-sharing services in the age of SSO are a dirty workaround designed to circumvent SaaS product segmentation (which would otherwise cause established companies to effectively subsidise tiny startups). I'm all for hacker philosophy, and perhaps this applies less to your situation than it does to the OP, but I do think the idea of credential-sharing is a horrible kludge that has only risen to prominence because of the specific issue that I mentioned, and which only leads to more problems with things like non-repudiation.
This has not been my experience. Trello is a good example. They have an enterprise tier that they basically starts at 100 users. Their business tier does not include SSO and I have a team of 60 people so the enterprise tier (which is about $250/person, by the way, compared to $12 a person for business) is out. Slack charges nearly double for their enterprise tier with SSO. I would not call not getting getting the tier down from the enterprise tiers a "dirty workaround" for most teams.
Yeah, I too hate the "call for pricing!" options and the "click here to be connected to our sales staff!" stuff, and SSO functionality being restricted to company accounts with >100 users or organisations that sign up for multi-year contracts. I also think the lack of white-label options for even enterprise-focused stuff is embarrassing. I'm not sure which of the two sides of this I hate more. In extreme cases, product offerings are bifurcated into:
- Sign up for free or with a credit card, but you'll run into problems (or at the very least friction/complications) if you end up trying to use if you something serious
- Speak to a salesperson and have your CFO sign the company up for a long-term strategic partnership.
The examples that you gave are less clear-cut though. Trello Business is $12.50 per month, and supports Google Apps SSO. Trello Enterprise supports general SSO, and costs $20.83 per month. Slack pricing is $6.67/mo for Standard, and $12.50/mo for Plus with SSO. None of these are costs that should really make or break the profitability of a company; considering that the business is using them to generate revenue or to reduce its expenses, how do they compare to other things like property/facilities expenses and employee salaries/benefits?
Just throwing this out there--Gitlab can be self-hosted (pretty quickly with a helm chart if you're running Kubernetes), and there are self-hosted alternatives to Slack and most other SaaS. Self-hosted Gitlab IIRC has an SSO config. If you have someone technical enough to set these up, it's an option.
If you have someone technical to set these up AND keep them up.
Many of those cool things take night or weekend to set up and that’s kind of fun to do. Regular patching and potential troubleshooting is the less fun part you get to do when adopting a new app.
Otherwise, thanks to many providers like Okta and others, SSO should really be a feature provided to smaller tiers nowadays.
We're a small business (2 founders, 3 contractors), and we'd love to use SSO for everything. But we're too small to afford enterprise tiers for things like Slack, Gitlab, etc.
Hopefully this trickles down eventually.
Update: I'd like to add that we provide a SaaS product as well, and have considered adding SSO to the enterprise tier but after much research we can't really find a good reason to restrict it (apart from "everyone else is doing it", and potential manual config).
But both SAML and OpenID connect have discovery protocols. Again, this CAN technically be self-configured by the right customer. But then, maybe the solution is to have a one-time config fee, rather than require a certain tier.