B2B Authentication and authorization

Problems

Currently, we do not offer an all-in-one (SAML, SCIM, user impersonation, etc) solution for multi-tenant authentication and authorization tailored specifically for B2B businesses. This is a hard requirement for some businesses to sign or continue existing contracts with optilyz.

Context

We currently provide our own custom developed authentication and authorization solution. Since it does not support or provide any SAML, SCIM or user impersonation feature we have considered integrating an IdP (Identity Provider) solution.

For choosing the IdP, we followed this list of requirements:

  1. (SAML) - Security Assertion Markup Language - an XML-based open-standard for transferring identity data between two parties: an identity provider (IdP) and a service provider (SP)
  2. (SCIM) - System for Cross-domain Identity Management - a set of application-level protocols to securely manage and communicate user data across multiple domains
  3. (User impersonation) - allows administrators to access and operate as if they were logged in as that user
  4. (Data sovereignty and residency) - how the data would be regulated and in which region would it reside
  5. (Hosted pages) - pre-built, customizable web pages hosted by the IdP that integrate seamlessly with the application
  6. (Pricing and feature plans) - the tariff and the available feature structures to which will be charged for the service

Options

The following IdPs were considered:

| Name | SAML | SCIM | User impersonation | Data EU sovereignty and residency | Hosted Pages | |:-----------|:-----|:-----|:-------------------|:---------------------------------------------------------|:-------------| | Clerk | YES | NO | YES | NO | NO | | Stytch | YES | YES | NO | NO | NO | | PropelAuth | YES | YES | YES | NO | YES | | Auth0 | YES | YES | NO | For the EU Region Dublin, Ireland and Frankfurt, Germany | YES |

Reasoning

Clerk

  • Single Sign-on - yes
  • Social Authentication - yes
  • Multi-factor Authentication - yes
  • SAML - yes
  • SCIM - no
  • User impersonation - yes
  • Data EU sovereignty and residency - no
  • Hosted Pages - no
  • Attack Protection - yes
  • Access Logs - yes
  • User Management - yes
  • Admin Platform Management - yes
  • Pricing plans - low

Verdict: rejected due to missing SCIM support

Stytch

  • Single Sign-on - yes
  • Social Authentication - yes
  • Multi-factor Authentication - yes
  • SAML - yes
  • SCIM - yes
  • User impersonation - no
  • Data EU sovereignty and residency - no
  • Hosted Pages - no
  • Attack Protection - yes
  • Access Logs - yes
  • User Management - yes
  • Admin Platform Management - yes
  • Pricing plans - low

Verdict: rejected, mainly due to missing User impersonation and missing Hosted Pages

PropelAuth

  • Single Sign-on - yes
  • Social Authentication - yes
  • Multi-factor Authentication - yes
  • SAML - yes
  • SCIM - yes
  • User impersonation - yes
  • Data EU sovereignty and residency - no
  • Hosted Pages - yes
  • Attack Protection - yes
  • Access Logs - yes
  • User Management - yes
  • Admin Platform Management - yes
  • Pricing plans - medium

Verdict: approved, mainly due to User impersonation and Hosted Pages. These features allow our Rentention and Product team to easily access a customer account and gives us a free Auth domain, allowing us to easily give customers access to their own Org Admin Dashboard to manage their user accounts.

Auth0

  • Single Sign-on - yes
  • Social Authentication - yes
  • Multi-factor Authentication - yes
  • SAML - yes
  • SCIM - yes
  • User impersonation - no (deprecated)
  • Data EU sovereignty and residency - for the EU Region Dublin, Ireland and Frankfurt, Germany
  • Hosted Pages - yes
  • Attack Protection - yes
  • Access Logs - yes
  • User Management - yes
  • Admin Platform Management - yes
  • Pricing plans - high

Verdict: rejected, mainly due to the missing (deprecated) User impersonation feature but also for the pricing plans which tend to be higher comparing to other IdPs

We have decided for the PropelAuth IdP since it does offer all the required features (see the Options table above) for an affordable pricing plan.

The Hosted Pages that PropelAuth offers is a key feature that helps us to:

  1. Speed up the implementation, maintenance and monitoring processes
  2. Fully customize to match our branding
  3. Manage user and organization accounts, API keys or audit logs
  4. Easily switch on/off features like email confirmation, password reset, social login, 2FA

Consequences

How do we implement this change?

We plan to introduce the new authentication and authorization process in small iterations by enabling it first for specific customers. We will gradually transition other customers while still keeping the current process for some.

Who will implement the change?

The Payment team will start implementing the new authentication and authorization process in small iterations and share their learnings afterward.

How do we teach this change?

The Payment team will run a workshop to introduce the use cases and concepts.

What could go wrong?

During the customers transition process we might accidentally lose or wrongly migrate existing credentials which eventually would lead for the users not being able to access the services.

What do we do if something goes wrong?

In case of wrongly imported or lost credentials we can check the database back-ups for the right data and redo the migration process. We plan to keep both authentication processes enabled until all the customers are migrated. This will allow to quickly switch back particular customers and do any issue investigation in parallel.

What is still unclear?

We do still investigate how the new authentication and authorization process should work for customers that do use integration marketing clouds like Emarsys or Salesforce.

Related ADRs

Not available