Interesting. I'm in the space (I work for FusionAuth) and I've seen the following trends:

- tons and tons of startups entering the space since the Auth0 acquisition by Okta in 2021. Probably due to a combination of: stickiness, standards, the fact the market was defined by Auth0 (so you don't have to define it or explain it), and the critical nature of it.

- providers focusing on time to market and ignoring OAuth/OIDC (or delaying delivery of standards based functionality): clerk, stytch

- providers focusing on certain use cases: workos (enterprise SSO), propelauth (b2b), clerk (react components to begin with, though they've expanded)

- self-hosting solutions with a more modern feel than Shibboleth and Keycloak (Duende Identity Server, FusionAuth, Zitadel, Ory)

- OSS providers monetizing by offering to operate their system, sometimes making it hard to find the download button so you can run it yourself

- hyper scaler solutions that are usually the default for folks building there, until limits are reached. These solutions include Cognito, Entra B2C (formerly Azure AD B2C), and Firebase.

It could be the folks I talk to, but most of them aren't interested in implementing auth themselves. They see it as undifferentiated functionality, like a database or message queue, and only worth implementing in certain specific circumstances. However, they're also worried about lock in. And they are thinking about the speed to market vs external dependency of SaaS offerings for critical application components.

However, choices really depends on team size and skillset. Startups are best served by using a SaaS offering or library framework that will give basic functionality and get out of the way so you can get to PMF and/or build features you can charge for. Bigger teams need more flexibility and have the ops skills to run auth themselves and remove the third party dependency.

Don't forget non-commercial stuff is happening in this area too.

For example: https://orcid.org/

Anyone who wants one can have their own Orcid Id in two minutes flat (and they're the only major SSO implementation i know that actually let's you keep your email private, other than Apple, i guess).

They support Oauth/OIDC, and you can even allow people to sign in to your own (non-commercial) service with their orcid via OIDC - it's no harder to setup the integration than Google or Facebook.

It's a backlink game.

Create a new site that is of some public good like this site. This site will probably gain domain and page authority much quicker than their main site and will attract more visitors and the key is that their page is linked through this auth.wiki site so their page (logto) will get the SEO benefit as well.

But personally I don't think this is an SEO play, more like a brand awareness thing. Some engineer at logto probably got pissed off with the state of auth documentation, went to his boss and proposed creating a simple static site with the "business case" being brand awareness and SEO.

Each page has a 'Edit on GitHub' button. You just need your changes to be approved, so I guess it's like a moderated wiki.

> Crontributing

This is probably just a typo, but I love the unintentional pun. A wiki was called that because it allowed quick edits by its users. Crontributing to this site takes much more time...

Thank you all for your suggestions and for pointing out issues and typos. I've updated the README to make the contributing section clearer.

added, thank you

here you go: https://auth.wiki/xacml

That is as may be (though I'm not sure it's quite as dire as all that), but I'd argue that if it isn't true that anyone can edit and see their changes instantly then it isn't really a wiki.

That doesn't mean wikis can't have bans, require captchas, or lock pages that are frequently abused to tenured registered users, but the tooling needs to support instant updates and freedom to edit needs to be the default. Otherwise you're looking at a static site or a CMS, not a wiki.

The most popular wiki sites just means that the community has to police the problem. Someone has to police the problem or else, even without spammers, you have people fighting grammar and typography wars over the math subreddits. You wake up one day and realize someone added their favorite kind of commas to every sentence across every major math article.

There needs to be gatekeeping.

It wasn't a fantasy, but it does belong to another age. The Internet was small back then and a much higher trust society. Today it's a war zone and everything must be locked down.

"Speak friend, and enter."

I didn't suggest no gatekeeping or moderation whatsoever. I explicitly qualified 'gatekeeping' with the word 'pre-emptive'.

A wiki allows anyone to edit by default and their changes are deployed without verification by another user. Moderation takes the form of locking specific pages on a case-by-case basis to users with tenure (who can still edit instantly) and rolling back misguided changes.

There's nothing wrong with having a site that isn't a wiki, but this is just a static site maintained by one person, so calling it a wiki is odd.

I'm gonna call hypertext 'microwiki' from now on