Have a look at ZITADEL (https://github.com/zitadel/zitadel or https://zitadel.com/), I think that does what you want. You can create multiple tenants (called Organizations) and you can setup security / login rules per organization such as enforcing MFA. Furthermore you can configure on each tenant a separate SSO and users are directly forwarded to their identity provider. When you first enter your username (could be an email) on the login screen, the policies of the user's organization will be applied. That allows you to route users based on their email domain etc. One additional thing to mention is that ZITADEL does not only handle authentication, but also authorization with self-service. Managers of an organization can, for example, assign users of their organization roles.

We built Stytch's B2B SaaS solution with this specific shortcoming in mind -- most other solutions aren't actually built with an organization-first data model (they're user-first like Auth0 but support the general concept of orgs), which makes it difficult to offer those per organization controls in an ergonomic manner.

There's some more info on our multi-tenancy data model here (https://stytch.com/docs/b2b/guides/multi-tenancy), and here's the PUT request you'd use to manage any of those org configurations: https://stytch.com/docs/b2b/api/update-organization

I’m also interested in this. We’ve been using Auth0 for a year and our contract is up for renewal where we will be getting kicked off of the startup plan. I’m wanting to rip the bandaid off early as we’re about to launch a new platform.

I’m highly considering bringing auth in house with Keycloak. I’ve run it in the past at previous companies so am familiar with it, but it’s going to be an extra thing to maintain due to self hosting, their themeing also is not great. However this is pretty much an end all solution that doesn’t really get expensive over time as our user base grows.

Wondering if folks have any advice?

Have you tried WorkOS? It’s built for exactly this, with native support for SAML and SCIM.

https://workos.com/

I’m the founder. Would love to hear your feedback and happy to answer questions.

Auth0 can do this. Identifier first login, SSO domain aliases, and MFA are all supported. They have an Organizations feature as well, but I'm not certain if you'd need that from what you've described. Customization of various aspects of the authn flow can be done via Actions (and Rules, but they're deprecated).

Hey, for authentik this is actually something we're actively working on: https://github.com/goauthentik/authentik/pull/8330, and this will be included in our next feature release in April!

(Disclaimer, I am founder and CTO of authentik)

We have this feature and it is called B2B SSO: https://www.ory.sh/docs/kratos/organizations

Most of the commercial solutions break financially when you have a freemium tier; orgs that don't pay below a certain size or usage. Yet the auth provider charges you the same fee for each such org.

Hmm. (I work for FusionAuth, thanks for giving us a try!)

So you want a screen in front of the login process where someone enters their email address, and then a second screen where a variety of login options are presented?

Along with the ability to enforce MFA on a per domain basis?

Anything else you are looking to customize at the domain level, such as password rules or registration ability?