WorkOS Blog

I started a startup to fix this exact problem integrating and configuring SSO/SAML.[0] We launched here on HN 5 years ago[1] and today power SSO for OpenAI, Cursor, Vercel, and a thousand other apps. We also found the initial configuration step to be painful for users, so we built a self-serve wizard that enables enterprise admins to fix issues.[2] It's still crazy how much complexity there is with enterprise identity systems and managing the user lifecycle for big orgs. It's like the whole thing is made of weird edge cases and even moreso when you add SCIM, RBAC, MFA, etc etc. (If anyone reading this also loves suffering at the intersection of IAM and developer tools, we are hiring! Email in my profile :)) [0] https://workos.com [1] https://news.ycombinator.com/item?id=22607402 [2] https://workos.com/admin-portal

Great looking project. Is this something that could replace https://workos.com ? - We have a number of customers that want to use their own authentication providers to access our applications. Would Ory provide such a bridge or are there any alternatives?

This looks great and super approachable. WorkOS[0] seems to be tackling something similar but more enterprise focused. [0]: https://workos.com/

This is a great write-up. He's mentioned in the article, but a major shout-out is warranted for ahacker1. He's doing really sophisticated and valuable work to secure SAML implementations. We at SSOReady are really appreciative of his work. Earlier this week, WorkOS put together a nice write-up on their own collaboration with ahacker1: https://workos.com/blog/samlstorm

As someone with a decade of hands-on SAML experience, I highly recommend against implementing SAML. Use OIDC instead. This article covers many of the reasons to avoid SAML: https://workos.com/blog/fun-with-saml-sso-vulnerabilities-and-footguns

Full disclosure: I work at WorkOS (https://workos.com/), we provide SSO (among other things) as a service. I glanced through the report and it comes to the normal conclusion that SSO is hard and expensive to get right. Do SMBs focus on providing value to their customers in the problem space that they are experts at or do they spend months just getting sign-in working? Yeah I get the concern about the "SSO tax" but unfortunately SSO isn't free. Someone is paying for it somewhere, be that implementation, outsourcing to a service, and/or maintenance and customer support for the live of the product. That said there are a lot more services and libraries out today that try to make this easier such as https://www.passportjs.org/ (which WorkOS sponsors).

WorkOS | Remote (US and Europe) | Full Time | https://workos.com WorkOS provides a single, elegant interface that abstracts dozens of enterprise integrations. This means developers can get up and running faster and can focus on their product instead of debugging legacy protocols and fragmented IT systems. We announced our Series B earlier this year: https://news.ycombinator.com/item?id=31582832 To learn more about who we are, our engineering culture, and whether this is the right place for you, read our Key Values profile: https://www.keyvalues.com/workos Our open roles are: - Product Designer - Developer Advocate - Software Engineer - Developer Success Engineer - Product Manager To apply check out https://workos.com/careers

I disagree. There are entire companies built around making it simpler to implement and manage SSO (like https://workos.com/ which we use) - it is time consuming to support. Enterprise pricing will always be about finding some way to gate enterprise users into a more expensive plans. Let's take Tuple as an example. You put "Active user pricing" into Enterprise plan. Why is that not "table stakes"? It does not involve complex tech, and not charging inactive users seems like a fair thing to offer all your customers? This blog post feels like a "beef marketing" play out of Basecamp's marketing book.

Great idea on the architecture blog post! Unfortunately there was a confusion on that TechCrunch piece. Stripe, Scale and Airtable are not WorkOS customers yet. However, there are some big names like Vercel, Webflow, Loom, and many others. [0] [0] https://workos.com/customers

The Work OS category is confusing since I was more familiar with WorkOS[0] already. I didn't connect how these were related (which they really aren't). [0] https://workos.com/

I work at WorkOS (we handle Enterprise SSO among other things, https://workos.com). We interface many... should I say "less elegant"... enterprise identity protocols with an OAuth api. There is support for common identity providers such as Azure, AD FS, Okta, VMware, to name a few. If you'd like access to our beta send me an email ([email protected]) and mention hn.

WorkOS (https://workos.com/) if you need to support single sign-on (SSO) for your app. SSO is free, and they offer other enterprise-focused features, like directory sync and audit trails.

WorkOS is incredible, and we've admired it from afar since launch. We'd like to use it, but aren't sure about the roadmap or applicability for SaaS “app” provider needs that otherwise seem like a perfect match. So, some questions: 1. First, do workplaces or SaaS app providers not need Android or iOS app support for in-house or client / customer facing apps? Swift and Kotlin SDKs seem conspicuous by their absence. https://workos.com/docs/sdks 2. Second, what about OIDC? I'd argue the majority of business and business employees do not need "SSO", the majority of benefits they think they'd get are met by OIDC ("Sign in with..." buttons) for users with the firm's controlled email address @ firm domain as the login username. A plurality of big firms seem covered just by "Sign in with Microsoft", and "Sign in with Google" to pick up startups or individuals, followed by GitHub for devs or Apple for retail wallet share. In our shoes, we'd far rather support clients through OIDC than SSO. 3. Third, Google has this covered if a startup bets on it, while Microsoft and AWS are a confusing melange of some 20 years of backwards compatibility, making bridging from devices into their Microsoft Entra or AWS IAM worlds hard to understand even if fully supported. At the same time, many businesses with real budgets are "required" by senior management to stay within those ecosystems. This calls for a frictionless experience and abstraction on top that uses the native mechanisms under…

Sure; see also https://WorkOS.com in this space.

WorkOS | Multiple positions | Remote (US timezones) | https://workos.com/ WorkOS is an early-stage technology startup that provides APIs to make cloud apps enterprise-ready. Our first offering allows developers to quickly add Single Sign-On (SSO/SAML) to their app. WorkOS is like Stripe for enterprise features. Here’s our HN launch: https://news.ycombinator.com/item?id=22607402 We are a small, nimble, fully-distributed team based in North and South America. We care deeply about building tools and perfecting the developer experience. We ship code every day. We have ambitious goals and are looking for talented people to join us. Our team values trust, empowerment, empathy, curiosity, speed, and intellectual rigor. If you love building developer tools and working at the intersection of product, engineering, and design, we'd love to hear from you. Technologies we use: * Next.js, NestJS, GraphQL * TypeScript * SDKs in 8+ languages (https://github.com/workos-inc) * Postgres * Heroku Positions: * Software Engineer - https://jobs.lever.co/workos/2333cdf9-5c71-4232-9dc8-4f18f6a1b719 * Engineering Manager - https://jobs.lever.co/workos/2adf7e5f-3e9b-4847-8e34-c52529c56472 * Developer Success Engineer - https://jobs.lever.co/workos/1fe7ef18-57c9-4aa2-b595-de7623a4b555 * Product Designer - https://jobs.lever.co/workos/dfde45ea-18fe-4aef-9660-0374f13ebe1c * any many more at https://jobs.lever.co/workos Please apply directly to the postings. Email…

First time I'm hearing about https://agentauthprotocol.com/ and https://workos.com/auth-md MCP and A2A weren't enough?

There's some active discussions on task level authz and multi-hop delegation in the OAuth WG right now. WorkOS wrote a good overview of the open drafts [1]. (Disclosure: one of them is mine.) [1] https://workos.com/blog/oauth-multi-hop-delegation-ai-agents

Utterly shameless plug, but recently at WorkOS I open sourced our OpenAPI spec to SDK pipeline: https://workos.com/blog/handwritten-sdks-are-dead We evaluated Stainless & Fern for our 8+ languages but ultimately I couldn’t justify the cost nor ceding control to another organization for something as important as platform DX.

I would argue that SMS is horribly insecure and should never be used for authentication. https://workos.com/blog/why-sms-mfa-is-insecure

You can run it yourself: https://workos.com/blog/how-to-run-deepseek-r1-locally

Besides the obvious (Stripe), WorkOS treats their docs as a product and is probably my all time favorite (just look at their arrow key shortcuts). WorkOS: https://workos.com/docs Twingate: https://www.twingate.com/docs/ Railway: https://docs.railway.app/ Planetscale: https://planetscale.com/ Evervault: https://docs.evervault.com/ Mintlify is also the best alternative to ReadMe or GitBook that I've found.

SAML signs "XML Documents". It does not sign the specific bytes of a document, you have to perform a transform to get the "canonical" version of the document and that's what you perform cryptography on. This creates a large surface for different implementations to be incompatible, subtly, but more importantly it creates a surface area for the nastiest bugs in authentication - When the sender and receiver have different interpretations of the message. This has lead to things like popular SAML parsers that do not even attempt to validate the signature. For examples of how this has gone badly wrong, see https://workos.com/blog/fun-with-saml-sso-vulnerabilities-and-footguns .

Had a quick look at your docs for integrating with Azure AD SAML https://workos.com/docs/integrations/azure-ad-saml and wondered why you don't make use of SAML metadata URLs that contain all this configuration? For example the signing certificates, ACS, Reply/ACS URL, EntityIDs are all in the metadata xml docs, so you could boil it down to: * Here's the SP metadata URL - upload it into Azure dashboard here ... * Grab the "App Federation metadata URL" from the Azure dashboard and paste it into WorkOS here ... (where your app can parse the XML and grab certs, URLs etc) And you're done.

https://hotwire.dev/ - alternative approach to building modern web applications by sending HTML instead of JSON over the wire. https://temporal.io/ - is the new kid on the block of state-dependent service-orchestrated application development platforms. https://workos.com/ - is building enterprise-readiness as a service, enabling new companies to start selling to enterprise customers with just a few lines of code. https://www.around.co/ - provides an AI-based camera framing designed for high-impact video calls. It helps users take video meetings less intrusive and less clunky. Age of Empires IV (https://www.ageofempires.com/games/age-of-empires-iv/) - The next chapter in the Age of Empires series that will take us back to the Middle Ages

I think one major difference between the Zanzibar implementations that are out there is support for the 'zookie' consistency token (as mentioned in the original paper). OpenFGA afaik doesn't implement zookies yet[1]. With zookies, each permission write generates a unique token that represents that particular write. Clients can store that token (per resource) and optionally provide it during runtime checks to ensure checks are consistent up to that write. It also helps the system guard against the 'new-enemy problem' (incorrect permissions checks due to permissions changes being read out of order) by ordering writes. I'd argue that it also unlocks a variety of caching implementations on the Zanzibar server while still allowing clients to specify desired consistency on a per-request/per-resource level. In other words, a Zanzibar implementation with support for zookies can guarantee consistency at a much higher throughput than one that relies on time (second, millisecond delay). This is important for generic 'read after write' scenarios. Disclaimer: I'm a former founder of Warrant[2] which was recently acquired by WorkOS. Our team has spent a ton of time building our Zanzibar-based authorization service (WorkOS FGA[3]) which supports zookies[4] and other Zanzibar concepts. [1] https://openfga.dev/docs/interacting/consistency#future-work [2] https://warrant.dev/ [3] https://workos.com/docs/fga [4] https://workos.com/docs/fga/warrant-tokens