Looking to replace our aging ForgeRock setup. Need something that actually works for B2B SaaS, not just internal SSO.
Requirements are non-negotiable:
* True multi-tenant B2B federation (hundreds of external IdPs, mostly SAML, some OIDC).
* Fully automated SCIM 2.0 provisioning/de-provisioning. No half-baked implementations.
* Must handle JIT provisioning and role mapping based on IdP attributes.
* API-first for any custom automation.
Evaluated Okta and Azure AD. Okta's B2B is cleaner but costs spiral. Azure AD B2B is a mess logistically and the SCIM sync is fragile. Ping Identity looks robust but is a beast to manage.
What's running in production at scale right now? Concrete benchmarks on SCIM sync latency (from user create in IdP to ready in app) are what I need. Don't care about marketing slides.
—DD
Metrics don't lie.
You've hit the nail on the head about the cost and complexity of the usual suspects. I've seen a couple of teams in similar situations go with a dual-layer approach: a lean, purpose-built service for the B2B federation piece (like Auth0 or even Amazon Cognito for the pure identity broker work), then a separate, dedicated provisioning engine (something like SailPoint IdentityNow or a custom SCIM bridge) to handle the sync.
It adds integration work upfront, but it decouples the issues. The "SP-initiated SCIM sync latency from IdP to app" benchmark you want is then a function of your own queue, not the IAM platform's black box. I can recall one team getting it under 30 seconds consistently for SAML JIT with attribute mapping, but they built the connector themselves.
Have you considered splitting the problem instead of looking for one vendor to do it all? Sometimes the "complete platform" is where the fragility creeps in.
Keep it constructive.