I’d argue that Keycloak is also Auth as a Service. Even if you may be hosting that service yourself.
If you only have a single web application (yes, that still exists) you don't need any of this. Use your backend framework's "native" auth package and you're good to go.
Re:UserFront: Auth Without Complexity
by blue_cookeh on Tuesday February 15, 2022 @05:13AM
(#30344692)
Working for $veryBigOrg passing all the compliance stuff off to Auth0/Okta/whoever is a big plus. Besides, they'll probably do better securing and auditing their user databases than we ever could.
Even working for small/medium org it's nice to outsource compliance.
Plus they have robot detection, mfa, captcha, etc out if the box.
Until part of the compliance is "no external services" :3
Re:UserFront: Auth Without Complexity
by AllModules on Tuesday February 15, 2022 @09:37AM
(#30346952)
> I'm not seeing anything about standards compliance
Thanks! We'll make a section to highlight them. We use the JWT standard (not sure if that is what you mean?), Oauth 2.0, SAML, etc... there are lots of standards in this space
I believe that they actually meant more like NIST/FIPS compliance type stuff so that big orgs that have to meet certain certifications will know if they can use your product or not.
EDIT: for example: https://auth0.com/security. SOC 2 is a big one.
What are your thoughts on something like this: https://github.com/authcompanion/authcompanion
Mind you, data residence and provenance may be more important in the use cases/applications I'm familiar with.
Then again, it is good to see a healthy standards based Authn/z ecosystem - good luck to all.
EDIT: After reviewing the site closer I'm not seeing anything about standards compliance.