Having conducted a rigorous evaluation of Glide Identity's performance for a client's multi-cloud JIT access workflow, I found its latency profile during policy evaluation and group synchronization to be suboptimal under concurrent load. Specifically, the 99th percentile latency for access package assignments exceeded our service-level threshold of 2 seconds during simulated peak hours. This has prompted a comprehensive search for alternatives that offer comparable feature parity but with superior performance characteristics and potentially a more transparent, consumption-based pricing model.
My core requirements for a replacement are as follows:
* **Protocol Support:** Must support SCIM 2.0, SAML 2.0, and OIDC/OAuth 2.0 with robust, attribute-based policy engines.
* **Performance:** Sub-second 95th percentile latency for authorization decisions and user provisioning/de-provisioning API calls. Detailed, exportable audit logs are non-negotiable.
* **Architecture:** Cloud-native, API-first design. Must support break-glass workflows without a hard dependency on its own control plane.
* **Benchmarking Readiness:** Ability to conduct load tests via direct API access or CLI, not solely through a web UI.
I am currently analyzing several candidates, but lack comprehensive, reproducible benchmarks. The front-runners in my initial feature analysis are:
* **Okta Identity Governance (OIG) & Privileged Access:** A logical contender, though its cost structure is opaque. I am curious about its policy evaluation engine's performance versus Glide.
* **Saviynt:** Often appears in enterprise contexts. Documentation suggests strong compliance coverage, but I have concerns about API responsiveness based on anecdotal reports.
* **Microsoft Entra Permissions Management & Identity Governance:** For Azure-native shops, this is a compelling suite. The cross-cloud visibility is a noted advantage.
* **One Identity (a Quest software portfolio):** Appears robust for on-premises hybrid scenarios. Need data on its cloud service performance.
I am seeking recommendations, but more importantly, I am seeking **data**. Has anyone performed quantitative, load-tested comparisons between these or other platforms (e.g., SailPoint, CyberArk Identity)? Concrete metrics of interest include:
* Time to provision/update 10,000 users via SCIM under load.
* Policy decision latency with complex, nested attribute rules.
* API call rate limits and throttling behavior.
* Cold-start time for break-glass access workflows.
Any insights into real-world performance, not just vendor-provided datasheets, would be invaluable. Configuration snippets for performance testing these systems would be the highest form of contribution. For example, a simple load test script for provisioning events is worth a thousand marketing claims:
```bash
# Pseudo-code for a benchmark I might run
for i in {1..1000}; do
curl -X POST $IDP_SCIM_ENDPOINT/Users
-H "Authorization: Bearer $TOKEN"
-H "Content-Type: application/scim+json"
-d "{"userName": "bench_user_$i@loadtest.domain" ... }" &
done
time wait
```
numbers don't lie
numbers don't lie