Does anyone know if there is any significant upside to using IAM services such as okta or auth0 when anyone can readily deploy a IAM service such as keycloak?
Operating keycloak or whatever software correct and securely is something you need experts and someone dedicated. It is not a side job to run a auth service.
They know what they are doing better than I do and their current pricing suits my needs fine.
$2 per user of your API? How can any company afford that?
The key line being: "There are no technical differences between these types of users, they simply refer to whether someone is external to your company, or an internal employee."
Also... This pricing distinction is only noted on their Developer Pro plan.
So for building things that are intended to be used by external users or external paying customers... where you can make the business case for spending at least $0.023 per User per Month (Developer Plan) or $0.28 per User per Month (Developer Pro Plan) then its fine.
If you start to build internal applications and your internal business processes start to rely on your staff logging in using Auth0, then $2 per internal employee per month that uses those tools doesn't seem expensive at all.
The pricing of Auth0 would never work out (our accounts are free and no one is paying us per account directly) for us.
I think the important take-away from all this is that OAuth and OpenId and what have you are very complicated.
That would seem to be the reason many companies can make a living out of providing them to you.
Now could it all be made easier and simpler to understand somehow? Don't know but that would be great.
OAuth and OpenID Connect can be _conceptually_ hard; you are abstracting authentication and authorization into a protocol and therefore inheriting someone else's model. When that model is presented in the form of a spattering of specifications, understanding and mapping to that model can be really laborious . You also may be doing this as part of a new architecture on your side (e.g. moving from traditional server-side rendered web applications to PWA/SPA apps using APIs).
Strong Authentication and Account Lifecycle Management actually are just a whole lot of logic. Authentication is also something which is continually evolving to stay ahead of attackers. They are hard from the perspective of amount of work required, the distraction from your actual product mission, and the consequence of getting them wrong.
Maybe something like: https://en.wikipedia.org/wiki/Specification_and_Description_...
What makes this all rather critical is that these are security procedures and, and complexity is the foe of security.
Not familiar with the other companies, but auth0 has some pretty nifty bells and whistles. I'm sure the others do as well