3
Security
Build vs buy for authentication in a B2B SaaS
Control ↔ Time-to-market
Context
Enterprise customers are asking for SSO (SAML/OIDC) and SCIM.
We have homegrown email/password auth. Enterprise prospects require SAML SSO, SCIM provisioning and audit logs. I'm the only security engineer.
Buying gets us there in weeks but per-MAU pricing scares finance. Building means owning SAML parsing — historically a minefield of signature-wrapping bugs.
Constraints
- Team
- 1 security engineer
- Deadline
- Q3 enterprise deal
Build in-housevsBuy (Auth0 / Clerk / WorkOS)
Community verdict
Build in-house 22%Buy (Auth0 / Clerk / WorkOS) 78%
9 engineers · 6 opinions
With these constraints, what would you choose?
One choice per engineer. You can change it any time.
Build in-house
Buy (Auth0 / Clerk / WorkOS)
Time-to-market →
Trade-offs
Dimensions
Build in-houseBuy (Auth0 / Clerk / WorkOS)out of 5
- Control
- 5Build in-house scores 5 of 52Buy (Auth0 / Clerk / WorkOS) scores 2 of 5
- Time-to-market
- 1Build in-house scores 1 of 55Buy (Auth0 / Clerk / WorkOS) scores 5 of 5
- Cost at scale
- 4
Community discussion
6 comments
Have you made this decision in production? Share your reasoning.
Sign in to commentKeycloak is the third option: self-hosted, SAML and SCIM supported, no per-user fees. You pay in operations instead of licence fees.
Enterprise customers will ask for SAML, SCIM provisioning, audit logs and MFA policies before they sign. Each of those is a quarter of work to build properly, and every one is security-critical.
Buy it, and spend the saved time on your actual product's authorisation model, which no vendor can do for you.
SCIM was the one that surprised us. Three enterprise deals stalled on it until we switched providers.
Negotiate pricing per organisation rather than per MAU — most B2B auth vendors will do it. Enterprise SSO is usually what closes the deal anyway, so the cost is easy to justify.
SAML is where I draw the line. XML signature validation has produced critical CVEs in mature libraries. Buy the enterprise-SSO piece; you can keep your own session handling.
Pricing per monthly active user gets steep for consumer-scale apps. Model the bill at 10x your current users before you commit; that was the point where we moved back to an open-source identity server.