We have a need to start rolling out two-factor authentication for our customers. I've looked at a bunch of vendors that provide different variations of 2FA, from Authy to Azure MFA to OpenOTP to Auth0. None of them are quite meeting my needs...
What I am after is something that:
- Is suitable for large numbers of external users who authenticate infrequently --> cost per user is unlikely to be cost effective unless the cost is a few cents per user
- Can "tack on" to the primary authentication platform rather than trying to provide a full authentication platform with login pages etc. (this would duplicate much of our current platform)
- Supports multiple options including SMS code, OTP (e.g. Google Authenticator) voice call, push notification
- Ideally has an SDK allowing us to embed the approval to a push notification into our own app
- Doesn't require (or allow, for that matter) the user to maintain their own contact details; we want to be the source of truth for contact details, not have two different sources getting out of sync)
- Doesn't require hardware tokens - not scalable for the number of users in question
OpenOTP looks fully featured but seems excessively complex for what we want - lots of moving parts to deploy and support. We're also more comfortable with Windows if possible but OpenOTP requires Linux.
Authy looks mostly pretty good except that users can update their contact details directly with Authy and we never hear about it, causing data sync issues for us.
Azure MFA looks pretty good but documentation is surprisingly sparse once you get past the basics. I'm finding it difficult to assess a few key areas like user provisioning (appears to be manual)...
The others I've looked at all have their own challenges: cost or cost model, missing features, complexity, etc. There are also numerous vendors that seem to target Enterprise MFA (staff access to internal and SaaS apps) and don't touch on customer MFA.
I'd really appreciate anyone's input into what products are out there that could address our needs in a cost effective way.
