WorkOS Blog

WorkOS is incredible, and we've admired it from afar since launch. We'd like to use it, but aren't sure about the roadmap or applicability for SaaS “app” provider needs that otherwise seem like a perfect match.

So, some questions:

1. First, do workplaces or SaaS app providers not need Android or iOS app support for in-house or client / customer facing apps?

Swift and Kotlin SDKs seem conspicuous by their absence.

https://workos.com/docs/sdks

2. Second, what about OIDC?

I'd argue the majority of business and business employees do not need "SSO", the majority of benefits they think they'd get are met by OIDC ("Sign in with..." buttons) for users with the firm's controlled email address @ firm domain as the login username. A plurality of big firms seem covered just by "Sign in with Microsoft", and "Sign in with Google" to pick up startups or individuals, followed by GitHub for devs or Apple for retail wallet share.

In our shoes, we'd far rather support clients through OIDC than SSO.

3. Third, Google has this covered if a startup bets on it, while Microsoft and AWS are a confusing melange of some 20 years of backwards compatibility, making bridging from devices into their Microsoft Entra or AWS IAM worlds hard to understand even if fully supported.

At the same time, many businesses with real budgets are "required" by senior management to stay within those ecosystems.

This calls for a frictionless experience and abstraction on top that uses the native mechanisms under…

WorkOS | Multiple positions | Remote (US timezones) | https://workos.com/

WorkOS is an early-stage technology startup that provides APIs to make cloud apps enterprise-ready. Our first offering allows developers to quickly add Single Sign-On (SSO/SAML) to their app. WorkOS is like Stripe for enterprise features. Here’s our HN launch: https://news.ycombinator.com/item?id=22607402

We are a small, nimble, fully-distributed team based in North and South America. We care deeply about building tools and perfecting the developer experience. We ship code every day. We have ambitious goals and are looking for talented people to join us. Our team values trust, empowerment, empathy, curiosity, speed, and intellectual rigor.

If you love building developer tools and working at the intersection of product, engineering, and design, we'd love to hear from you.

Technologies we use:

* Next.js, NestJS, GraphQL

* TypeScript

* SDKs in 8+ languages (https://github.com/workos-inc)

* Postgres

* Heroku

Positions:

* Software Engineer - https://jobs.lever.co/workos/2333cdf9-5c71-4232-9dc8-4f18f6a1b719

* Engineering Manager - https://jobs.lever.co/workos/2adf7e5f-3e9b-4847-8e34-c52529c56472

* Developer Success Engineer - https://jobs.lever.co/workos/1fe7ef18-57c9-4aa2-b595-de7623a4b555

* Product Designer - https://jobs.lever.co/workos/dfde45ea-18fe-4aef-9660-0374f13ebe1c

* any many more at https://jobs.lever.co/workos

Please apply directly to the postings.
Email…

I think one major difference between the Zanzibar implementations that are out there is support for the 'zookie' consistency token (as mentioned in the original paper). OpenFGA afaik doesn't implement zookies yet[1]. With zookies, each permission write generates a unique token that represents that particular write. Clients can store that token (per resource) and optionally provide it during runtime checks to ensure checks are consistent up to that write. It also helps the system guard against the 'new-enemy problem' (incorrect permissions checks due to permissions changes being read out of order) by ordering writes.

I'd argue that it also unlocks a variety of caching implementations on the Zanzibar server while still allowing clients to specify desired consistency on a per-request/per-resource level. In other words, a Zanzibar implementation with support for zookies can guarantee consistency at a much higher throughput than one that relies on time (second, millisecond delay). This is important for generic 'read after write' scenarios.

Disclaimer: I'm a former founder of Warrant[2] which was recently acquired by WorkOS. Our team has spent a ton of time building our Zanzibar-based authorization service (WorkOS FGA[3]) which supports zookies[4] and other Zanzibar concepts.

[1] https://openfga.dev/docs/interacting/consistency#future-work

[2] https://warrant.dev/

[3] https://workos.com/docs/fga

[4] https://workos.com/docs/fga/warrant-tokens

I started a startup to fix this exact problem integrating and configuring SSO/SAML.[0]

We launched here on HN 5 years ago[1] and today power SSO for OpenAI, Cursor, Vercel, and a thousand other apps. We also found the initial configuration step to be painful for users, so we built a self-serve wizard that enables enterprise admins to fix issues.[2]

It's still crazy how much complexity there is with enterprise identity systems and managing the user lifecycle for big orgs. It's like the whole thing is made of weird edge cases and even moreso when you add SCIM, RBAC, MFA, etc etc.

(If anyone reading this also loves suffering at the intersection of IAM and developer tools, we are hiring! Email in my profile :))

[0] https://workos.com

[1] https://news.ycombinator.com/item?id=22607402

[2] https://workos.com/admin-portal

Full disclosure: I work at WorkOS (https://workos.com/), we provide SSO (among other things) as a service.

I glanced through the report and it comes to the normal conclusion that SSO is hard and expensive to get right. Do SMBs focus on providing value to their customers in the problem space that they are experts at or do they spend months just getting sign-in working?

Yeah I get the concern about the "SSO tax" but unfortunately SSO isn't free. Someone is paying for it somewhere, be that implementation, outsourcing to a service, and/or maintenance and customer support for the live of the product.

That said there are a lot more services and libraries out today that try to make this easier such as https://www.passportjs.org/ (which WorkOS sponsors).

https://hotwire.dev/ - alternative approach to building modern web applications by sending HTML instead of JSON over the wire.

https://temporal.io/ - is the new kid on the block of state-dependent service-orchestrated application development platforms.

https://workos.com/ - is building enterprise-readiness as a service, enabling new companies to start selling to enterprise customers with just a few lines of code.

https://www.around.co/ - provides an AI-based camera framing designed for high-impact video calls. It helps users take video meetings less intrusive and less clunky.

Age of Empires IV (https://www.ageofempires.com/games/age-of-empires-iv/) - The next chapter in the Age of Empires series that will take us back to the Middle Ages