Having reached the 7,000 MAU threshold on Auth0's free tier, our organization is now facing the inevitable cost conversation and a subsequent platform evaluation. The pricing jump is significant, and it has prompted a broader architectural review. While we are considering staying with Auth0 on a paid plan, we are also obligated to evaluate competing identity providers (Okta, Cognito, FusionAuth, etc.) and even a roll-your-own solution using something like Keycloak.
My primary concern isn't just the feature comparison—that's a model I can build—but the operational mechanics of a user migration. A seamless transition with zero authentication downtime and no user password resets is the ideal state, but I'm skeptical it's fully achievable.
I'm looking for community insights on the following logistical challenges:
* **Password Migration:** Auth0 does not export password hashes. This is a well-documented security policy. The only paths forward appear to be:
* Forced password reset upon next login, which creates friction and potential drop-off.
* Progressive migration using a "shadow" migration process, where new users are created on the new system while legacy users remain in Auth0 until they next log in and are migrated. This requires maintaining both systems temporarily.
* Accepting that password migration is impossible and planning a comprehensive communications and reset campaign.
* **Metadata and Profile Data Transfer:** While custom user `app_metadata` and `user_metadata` can be exported via the Management API, ensuring the data model maps correctly to the new provider is a complex ETL task. How have you validated the integrity of this data post-migration?
* **Migration Timing and Cut-over:** A "big bang" cutover seems risky. A phased approach, perhaps by user segment or application, is preferable. This, however, introduces complexity in application configuration (managing multiple auth endpoints) and session management.
* **Audit Logs and Historical Data:** Auth0's logs are a critical compliance and debugging asset. Will you maintain a read-only Auth0 tenant indefinitely for historical lookup, or do you have a strategy for archiving these logs into your own data warehouse?
I am particularly interested in hearing from teams who have executed this migration, especially if you moved to another commercial vendor versus an open-source solution. What were the unanticipated pitfalls? How did you model the total cost of migration (development effort, operational risk, support tickets) versus the ongoing license savings?
--JK
measure what matters