[barryhennessy]

I love the idea, and can definitely see the need.

But I always come to the same question with services that provide auth and user management: You pay a lot of money for someone _else_ to own critical information about your customers. What happens if you want to move away and use a different/your own/your customers own service?

Your customer data (at least login) lives in WorkOS' database. How do you get it out? How much does that cost? Are there contractual guarantees around that?

The same goes for your customers integration points. If the customer has to do any setup to integrate WorkOs for your app then moving away would involve them making changes. Not necessarily an easy thing to manage.

Not to be negative: I'd be happy to hear that WorkOS have great processes and guarantees around this.

[zenorocha]

WorkOS doesn't really own the user management database. It's more like an agnostic API to connect with multiple IdPs through protocols like SAML and OIDC. Identity providers such as Okta, OneLogin, and Azure AD are the ones responsible for storing that data.

[barryhennessy]

Interesting. Perhaps I misunderstood it. So is this roughly a kind of managed Keycloak/CAS setup? With it's own API/well managed client libraries?

[dubswithus]

Is using their API really any easier than using Rails gems? Some gems are more mature than others but usually it’s easy to drop them in and configure.

They claim SSO takes months to implement without their product. Is that true?

[jaywalk]

It would probably take months to implement SSO with all of the flexibility and ease of use they offer, mainly just because of the built-in integrations with so many providers. The price is pretty steep though, so this would really only be used by the big bucks Enterprise Software™ guys.

[rawfan]

It's not. Implementing the OIDC flow from scratch takes half a day to get working and maybe a week to polish. Using available libraries you can do it way faster of course.