December 2023 Summaries

In 2023, WorkOS released over 40 new features and updates across its User Management, Single Sign-On (SSO), Directory Sync, and Audit Logs products. Key highlights include achieving 99.99% availability for SSO, Directory Sync, and Audit Logs; introducing Groups for SSO users; adding support for SAML login and domain hints; improving the validation of OIDC connections; enhancing user provisioning via SFTP; consolidating group membership fragmentation; offering a guide to just-in-time user provisioning; supporting GitHub OAuth; providing migration guides for AWS Cognito, Auth0, and Firebase; enabling custom domains for Admin Portal invite emails; allowing admins to be invited to the Admin Portal via email; improving validation during SCIM setup; introducing Domain Verification API; offering an Audit Logs API to define event schema; adding a new Log Streams destination: Google Cloud Storage; and providing a Bubble plugin.

Single Sign-On (SSO) and Federated Identity Management (FIM) are tools that enable access to multiple applications without requiring separate logins for each application. While they may seem similar, there are key differences between the two. SSO allows users to authenticate once in a single place to access apps within a single organization, while FIM enables organizations to access apps on different domains using a single set of credentials. Both tools improve user experience and security by reducing the number of passwords needed and simplifying identity management. To implement SSO and FIM for multiple enterprise customers, consider using a done-for-you authentication service like WorkOS.

SCIM (System for Cross-Domain Identity Management) and SAML (Security Assertion Markup Language) are two protocols that help developers implement a full authentication solution and manage the user account lifecycle. While SCIM focuses on ensuring two systems are synced at any point in time, SAML is focused on the actual Single Sign-On (SSO) login process. Both protocols complement each other to provide an efficient and secure way for enterprise customers to authenticate users and manage access across their estate. Developers can implement SCIM and SAML manually or use dedicated providers like WorkOS, which offer support for various vendors, normalized attributes, provisioning events handling, self-service onboarding, and easy integration.

The main differences between SAML 2.0 and SAML 1.1 include the ability of SAML 2.0 messages to be signed and encrypted in their entirety, while SAML 1.1 messages cannot; SAML 2.0 supports a wider range of attributes such as user roles, whereas SAML 1.1 only supports limited attributes typically indicating who was authenticated, how, and when; SAML 2.0 supports many more bindings like HTTP Redirect (GET), SAML URI, and reverse SOAP, while SAML 1.1 only defines a SOAP binding explicitly; SAML 2.0 supports Single Logout (SLO) while SAML 1.1 doesn't; and SAML 2.0 supports metadata while SAML 1.1 doesn't. The transition to SAML 2.0 was necessary due to the limitations of SAML 1.1, including its lack of flexibility, limited authentication options, and vague specifications in areas such as metadata exchange and session management.

The System for Cross-domain Identity Management (SCIM) is an open standard that enables the exchange of user information between applications. It uses a REST API to share data about user identities and attributes in JSON or XML format. SCIM attributes allow you to define both users and groups, and store information about them and their relationships. The standard includes various types of attributes such as common, default, and enterprise user attributes. Custom attributes can also be added to capture additional details specific to an application. Implementing SCIM in your app allows for seamless communication with major identity providers like Azure AD/Entra ID, Okta, or Google Workspace without the need for custom implementations tailored to each provider's quirks.

SAML (Security Assertion Markup Language) is an XML-based standard used to enable Single Sign-on (SSO) by allowing an identity provider to provide authentication across multiple services with a single login. It's supported by every major IdP in use today and allows users to sign in once and access multiple applications without signing in again. SAML assertions can include Authentication, User Attributes and Authorization Decisions. SAML is commonly used for Single Sign-on (SSO), Attribute Exchange, and User Provisioning. Alternatives to SAML include OpenID Connect and OAuth.

OAuth and JWT are both open standards that can form a core part of any SaaS application's authentication stack. While OAuth is an open standard for access delegation commonly used for both authentication and authorization, JWTs are compact tokens used for secure transmission of information between parties. For most scenarios, the combined approach works best: use OAuth for initial authentication and authorization, then issue that access token as a JWT. This provides the security and convenience of single sign-on with the flexibility of JWTs.

OIDC (OpenID Connect) and SAML (Security Assertion Markup Language) are two popular authentication protocols used for Single Sign-On (SSO). While they both handle the authentication process, they use different authentication flows and data formats. OIDC is built on top of OAuth 2.0 and allows users to log in to multiple apps using their existing identity from an OpenID provider like Google or Microsoft. It's commonly used in modern web and mobile apps. SAML is an XML-based SSO protocol that standardizes how an Identity Provider (IdP) and a Service Provider (SP) exchange authentication and authorization data. It's used in legacy enterprise environments to enable web SSO. In most cases, it's worth supporting both OIDC (for enterprise SSO and social logins) and SAML (for legacy enterprise SSO) to cater to a broader customer base.

Multi-Factor Authentication (MFA) is an added security layer to applications, making it harder for hackers or impersonators to steal and use user credentials. MFA requires two types of identification: something the user knows (password), and something the user has (device). Passwords are inherently insecure, so adding a second layer of authentication significantly improves account security. MFA is crucial for businesses as it prevents devastating data breaches that can cost millions. It's especially important for consumer-focused apps handling sensitive data like banks and credit cards. Implementing MFA involves significant backend changes and frontend adjustments to accommodate the additional authentication steps.

To become "Enterprise Ready," AI companies must prioritize security, compliance, reliability, and support requirements demanded by large organizations. This includes implementing Single Sign-On (SSO) from the start, achieving Service Organization Control 2 (SOC 2) compliance, ensuring strong safeguards for sensitive customer data processed in LLMs, and focusing on core product development over non-proprietary features. WorkOS supports high-growth AI companies in achieving Enterprise Readiness by providing scalable and secure enterprise features, allowing them to focus on their core competencies while meeting the demands of large organizations.

To become "Enterprise Ready," AI companies must prioritize security, compliance, reliability, and support requirements demanded by large organizations. This includes implementing Single Sign-On (SSO) from the start, achieving SOC 2 compliance, and focusing on core product development over non-proprietary features. The downstream impact of SOC 2 compliance helps customers maintain their own compliance status, while strong safeguards for sensitive customer data being processed in LLMs are essential. WorkOS supports high-growth AI companies in achieving Enterprise Readiness by providing scalable and secure enterprise features, allowing them to focus on their core competencies.

In November, WorkOS released several product updates including User Management APIs (free up to 1 million MAUs), Domain Verification API, Dashboard SAML for all teams, and the Enterprise Readiness Guide for Product Managers. The User Management APIs provide a comprehensive authentication solution with features like email verification, account linking, bot blocking, organization modeling, and more. Migration guides are available for Auth0, Firebase, and Cognito. The Domain Verification API enables IT admins to verify domain ownership by creating and verifying DNS TXT records. Teams can now use SSO to sign in to the WorkOS Dashboard with SAML authentication available at no additional cost. Additionally, Directory Validation for Google Workspace, SFTP, and Workday identifies setup misconfigurations and provides instructions on how to fix them. The Enterprise Readiness Guide for SaaS Product Managers covers ideal timing for moving upmarket, the enterprise roadmap, build vs. buy considerations, and pricing & packaging.

Seamless Single Sign-On (SSO) by Microsoft is a version of SSO specifically designed and optimized to tie in with the Microsoft ecosystem. It allows users to authenticate once and then access multiple different services and apps, mediated by Microsoft's Entra ID. Seamless SSO uses Entra ID's directory system to store users and what they can access and enables "silent logins" with Microsoft 365 products like PowerPoint and Teams. It is also optimized for authentication on Windows devices using the Integrated Windows Authentication service. Over the years, Seamless SSO has persisted through a few name and product changes alongside Microsoft's Active Directory. Implementing Seamless SSO involves setting up an Entra server via Azure, enabling Seamless SSO inside Entra Connect, deploying it to users via Group Policy, and testing its functionality.