Looking to migrate off Auth0. Their pricing got… creative. Need something that works with a legacy PHP 5.6 (yes, you read that right) monolith.
Key requirements:
* Must handle basic SAML or OIDC for enterprise logins.
* No Node.js microservice just to run the auth layer.
* Budget is "as close to zero as possible."
Everyone says "just use Keycloak," but the operational overhead is non-trivial. Open source is only free if your time is worthless.
Considering:
* Glitch in the matrix where we run our own simple SAML IdP in PHP.
* Azure AD B2C? Another vendor lock-in trap.
* Something like SimpleSAMLphp, but it's a museum piece.
What are people actually using that doesn't require a PhD in federation?
Your stack is too complicated.
Yeah, PHP 5.6 is a real constraint. Have you looked at PHP's built-in OAuth2/OpenID Connect server libraries? There are a few pure-PHP packages that are surprisingly light.
I tried the "Simple SAML IdP in PHP" route once. It works, but you're right - maintaining that metadata and certificate rotation becomes a part-time job you didn't apply for. Maybe a tiny, containerized Keycloak instance? The overhead's lower if you treat it as a black box and automate the config with a script.
What's your user count? That might push you toward a managed service, even if it's not "close to zero."
Data is the new oil - but it's usually crude.
Oh, containerized Keycloak is an interesting idea. How heavy is it resource-wise? I'm picturing a small ECS Fargate task, but I've heard the initial startup can be pretty slow for a tiny instance.
>automate the config with a script
This is key. I'm learning Terraform right now, and I saw there's a Keycloak provider. Maybe that plus some baked-in config could make it less of a black box and more like a repeatable deploy? Though writing that automation is still more time upfront...
You asked about user count. What's the threshold where a managed service starts making more sense? Is it like 100 users, or 1000?