In July 2012 the editor of the OAuth 2.0 specification quit. Eran Hammer had held the pen for years: at the IETF the editor is the person who writes the normative text and arbitrates the design while the working group argues, not a proofreader. He had edited the published OAuth 1.0 standard before it. He pulled his name off 2.0, walked away, and published a much-read post called "OAuth 2.0 and the Road to Hell."
His complaint was not academic. The protocol, he wrote, had been hollowed out into "a blueprint" that each vendor would profile into its own incompatible product. He called that "the enterprise way," the "WS-* way." And he warned, in as many words, that 2.0 "provides a whole new frontier to sell consulting services and integration solutions." RFC 6749 shipped three months later with Dick Hardt's name on it instead.
Fourteen years on, switching on the corporate login your largest customer is demanding costs around $125 per connection per month, or sits behind a tier named "Enterprise," or behind a "contact sales" button that adds three weeks to a deadline you were already late for. Hammer saw the shape of that in 2012, from inside the room where it was being decided.
So it is worth walking the whole thing back: who wrote these standards, what they thought they were building, and how it turned into a line item. The moat that came out of it is real. It is also made of two different materials, and only one of them is still holding.
The protocols were finished before the pricing was
By 2015 the standards work was essentially done. SAML 2.0 landed as an OASIS standard in March 2005, which is to say it predates the iPhone. OAuth 2.0 was published as RFC 6749 in 2012. OpenID Connect built identity on top of it in 2014. SCIM, the protocol that provisions and deprovisions users across systems, reached its 2.0 revision (RFCs 7642 through 7644) in September 2015. The four pieces that make up "enterprise auth" were specified, interoperable, and free to implement more than a decade ago.
Nothing about them has changed materially since. A SAML assertion signed today looks like a SAML assertion signed in 2008. That rules out the usual justification for a premium: novelty. Enterprise SSO is not a frontier feature that costs a fortune to keep building, and it costs a provider no more to serve a login that arrived over SAML than one that arrived with a password. It is settled infrastructure. Which raises the question of where the price came from, if not from the engineering.
The working groups that wrote it were not sales teams
Start with who wrote the specifications, because it explains a lot. SAML did not emerge from a pricing meeting. It came out of an OASIS technical committee, and the founding chair of that group was Eve Maler, then a technology director at Sun Microsystems, who had spent years on the markup and federation standards that made cross-company sign-on possible at all. The output was a public document anyone could implement, for nothing.
The mood of that era was openness, not enclosure. In August 2005, at O'Reilly's OSCON, Dick Hardt of Sxip Identity delivered a rapid-fire keynote titled "Identity 2.0" that has been watched and re-watched ever since. The pitch was a web where your identity was yours and portable, carried between sites rather than locked inside each one's directory. A year later, OAuth began the same way. Blaine Cook, building Twitter's API, wanted a way to let one app act on your behalf at another without users handing over their passwords, found no open standard for it, and sat down with Chris Messina, David Recordon and a handful of others in early 2007 to write one. The first OAuth spec shipped later that year. Nobody in that group was trying to build a toll booth. They were trying to stop the web from asking people for their passwords.
What Hammer was actually warning about
Then the standard grew up, and the room changed. OAuth 2.0 set out to generalise the first version, and the working group filled with larger interests. Compared with 1.0, Hammer wrote on his way out, the result had become "more complex, less interoperable, less useful, more incomplete, and most importantly, less secure." The comparison he reached for, the WS-* stack of the previous decade, was the industry's clearest example of an open specification turning into a market for integration work.
Read that back with a decade of hindsight and it lands as a forecast. The thing that would eventually be metered by the connection was already, in 2012, being shaped by the people who would go on to do the metering. OpenID Connect put identity back on a clean footing on top of OAuth 2.0 in 2014, drafted by Nat Sakimura at Nomura Research Institute with John Bradley and Mike Jones, and it is genuinely good work that the whole industry still runs on. But look at where its authors sat: Bradley at Ping Identity, Jones at Microsoft. The specifications stayed open and free to implement. The people writing them increasingly worked for the companies that would sell the result.
The same people who wrote the standard went on to sell it
The commercial layer did not arrive from outside the standards world. It grew straight out of it, often through the same hands. Eve Maler, who chaired the group that produced SAML at Sun, joined ForgeRock in 2014 as its VP of innovation and later became its chief technology officer. ForgeRock was itself built on the identity stack Sun had open-sourced as OpenSSO, and in 2023 it was folded into Ping Identity. Ping dates to 2002, early enough to help write the federation playbook it then sold for two decades. None of this was underhanded. The point is narrower and stranger: the open specification and the priced product were never two separate worlds. The same expertise wrote both.
The cloud generation inherited the pattern, and the pricing instinct rode along with it. Okta was founded in 2009 by Todd McKinnon, who had run engineering at Salesforce, and Frederic Kerrest; it went public in 2017 and, in 2021, paid $6.5 billion in stock for Auth0. Auth0 was the developer-friendly one, started in 2013 by two Argentine engineers, Eugenio Pace and Matías Woloski, who had met doing consulting work and set out to make adding login to an app a few API calls. That a company whose entire pitch was developer convenience was still worth six and a half billion dollars is the tell: whoever owns the login box owns a road every other feature has to drive across. The most recent wave says the quiet part in its marketing. WorkOS, founded in 2019 by Michael Grinich, sells what he calls crossing the "enterprise chasm," making a product "enterprise-ready" by supplying precisely the pieces that get metered: SSO, directory sync, audit logs. SSO is the enterprise piece. SSO is where the money is. So SSO is what gets a price tag.
Why the price tracks your deadline, not the code
Rob Chahin noticed the pattern and, in 2019, started a public list at sso.tax, the "SSO Wall of Shame," cataloguing how much software companies charge to switch SAML on. Some of the markups are absurd on their face: a base plan that multiplies several times over the moment SSO appears on it. The list is long because the strategy works.
It works because of when the buyer needs the feature. Nobody shops for SSO on a calm afternoon. You need it the moment a large customer's security team makes it a condition of signing, or the week your own SOC 2 auditor asks how you enforce access. You need it against a deadline, with a deal or a certificate on the line, and you need it now. That is the least price-sensitive moment a buyer ever has, and the pricing is built around it. The premium was never calibrated to the marginal cost of a SAML implementation, which rounds to nothing. It was calibrated to how little leverage you have on the day you finally need it.
That is the real shape of the thing people call the SSO tax. Not a price on a feature. A price on a deadline.
What the moat is actually made of
So how defensible is that position? The moat the entrenched players hold is real, but it is made of two separate materials, and they are not equally solid.
The first is complexity. SAML is old, but it is not simple to implement well. Signature validation, XML canonicalization, encrypted assertions, metadata that rotates, and the long tail of quirks that every identity provider ships differently: getting all of it correct, and secure, has historically been weeks of specialist work, and a rich source of security bugs when done wrong. SCIM adds its own surface. Building this once was a genuine investment. Building it against every IdP your customers might bring, and operating it reliably, was a moat you could park a company behind.
The second material is trust. An enterprise security team has to accept your identity layer, and that means SOC 2, penetration tests, a track record, a company that will still exist in five years, and someone to call at 2am when federation breaks. No amount of clever code shortcuts that. It is earned slowly, and it is the harder half of the moat by a wide margin.
For twenty years those two halves reinforced each other, and the pricing treated them as one indivisible thing. They are not one thing.
The half of the moat that AI is draining
Here is what changed. The complexity half of that moat was, at bottom, a knowledge and labour problem: the protocols are well specified and heavily documented, but wiring them up correctly took scarce, expensive expertise and a lot of hours. That is precisely the sort of problem AI coding assistants are good at. A settled, twenty-year-old standard with abundant public reference implementations is close to a best case for them. Work that used to need an identity specialist for a month increasingly needs a competent engineer and a good assistant for a week.
Be careful about what that does and does not erode. It does not touch the trust half. AI does not hand you SOC 2, a security reputation, or an on-call rotation, and if anything the flood of machine-generated auth code makes a vetted, battle-tested provider more valuable, not less. But it takes a chainsaw to the complexity half. That matters, because the pricing was quietly leaning on both halves at once. When implementing SAML stops being a moat and starts being a weekend, "enterprise-only" is no longer a statement about what is hard to build. It is a statement about what the vendor has chosen to charge for. The capability gap is closing faster than the price list admits.
One small team giving the taxed features away
We are one data point in that argument. Authagonal is a small team, and SSO, SAML, and SCIM are not our upsell; they sit on the free tier, with unlimited connections, up to 250 monthly active users, no card required. The paid plans start at $29 a month and carry the same feature set at every tier. Set that against the market's going rate for the identical capability: WorkOS meters SSO at around $125 per connection per month and SCIM at another $125; Clerk gives you one connection, then about $75 for each after; Auth0 bundles one connection free to 25,000 users, then routes production SSO onto its pricier business line. We are not cheaper because we found a trick. We are cheaper because the feature costs close to nothing to provide, and we declined to price it as though it were scarce.
None of this means the incumbents are about to fold. The trust half of their moat is real, and they have spent two decades building it. But the story that enterprise auth is expensive because it is hard is getting harder to tell with a straight face, right as the tools that make it easy reach everyone. To see what the features cost once you stop paying the tax, our pricing puts every one of them on the same plan, and the SSO tax calculator will price your exact setup against the vendors still metering it.
Top comments (0)