Readit Newshttps://help.openai.com/en/articles/9627404-openai-chatgpt-s...
I'm not exaggerating; you can use the search bar and find longer comments from me on SAML and XMLDSIG. You might just as well ask when we're going to implement DNSSEC.
Here is a major vulnerability we disclosed earlier this year:
It's pretty incredible the level of UI engineering that went into it.
Some screenshots I took: https://x.com/grinich/status/1963744947053703309
I missed OpenAI migrating away from auth0. They must have been one of their largest customers - anybody know the story?
WorkOS does exactly this. It's "Stripe for enterprise features."
Our customers include OpenAI, Anthropic, xAI, Cursor, Perplexity, Vercel, Replit, Webflow, Clay, Hex, Carta, Plaid, Drata, Vanta, and many others. If you've used these products, you've used WorkOS!
WorkOS makes it easy to "cross the enterprise chasm." Here's a bit more of the backstory: https://x.com/grinich/status/1841569664465568248
We also launched on HN 5 years ago :) https://news.ycombinator.com/item?id=22607402
We launched here on HN 5 years ago[1] and today power SSO for OpenAI, Cursor, Vercel, and a thousand other apps. We also found the initial configuration step to be painful for users, so we built a self-serve wizard that enables enterprise admins to fix issues.[2]
It's still crazy how much complexity there is with enterprise identity systems and managing the user lifecycle for big orgs. It's like the whole thing is made of weird edge cases and even moreso when you add SCIM, RBAC, MFA, etc etc.
(If anyone reading this also loves suffering at the intersection of IAM and developer tools, we are hiring! Email in my profile :))
If I were to do it, I would have most of the reusable code (e.g. of a RBAC system) written and documented once and kept unpublished. Then I would ask an AI tool to alter it, given a set of client-specific properties. It would be easier to review moderate changes to a familiar and proven piece of code. The result could be copied to the client-specific repo.