mirror of
https://github.com/hanzoai/papers.git
synced 2026-10-29 07:34:31 +00:00
109 lines
3.9 KiB
TeX
109 lines
3.9 KiB
TeX
\section{Identity: Hanzo IAM}
|
|
|
|
\label{sec:identity}
|
|
%% ============================================================================
|
|
|
|
\subsection{Overview}
|
|
|
|
Hanzo IAM is a multi-tenant identity and access management system implemented as a single Go binary with zero external dependencies beyond PostgreSQL. It supports OAuth~2.0, OpenID Connect, SAML~2.0, LDAP, WebAuthn/FIDO2, and direct username/password authentication. IAM integrates with over 40 social identity providers (Google, GitHub, Apple, Microsoft, Discord, Telegram, etc.) and implements Casbin-based RBAC with per-organization policy engines.
|
|
|
|
\subsection{Feature Matrix}
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{Identity provider feature comparison.}
|
|
\label{tab:identity}
|
|
\footnotesize
|
|
\begin{tabular}{@{}lccccc@{}}
|
|
\toprule
|
|
Feature & \rotatebox{60}{Hanzo IAM} & \rotatebox{60}{Auth0} & \rotatebox{60}{Clerk} & \rotatebox{60}{Supabase} & \rotatebox{60}{Firebase} \\
|
|
\midrule
|
|
Social providers & 40+ & 30+ & 20+ & 12 & 7 \\
|
|
OIDC server & \yes & \yes & \no & \no & \no \\
|
|
SAML 2.0 & \yes & \yes & \no & \no & \no \\
|
|
WebAuthn/FIDO2 & \yes & \yes & \yes & \no & \no \\
|
|
LDAP bridge & \yes & \yes & \no & \no & \no \\
|
|
SCIM 2.0 & \yes & \yes & \no & \no & \no \\
|
|
Casbin RBAC & \yes & \no & \no & \no & \no \\
|
|
Org hierarchy & \yes & \yes & \yes & \no & \no \\
|
|
Self-hostable & \yes & \no & \no & \yes & \no \\
|
|
Open source & \yes & \no & \no & \yes & \no \\
|
|
Argon2id hash & \yes & \no & \no & \yes & \no \\
|
|
MFA (TOTP+HW) & \yes & \yes & \yes & \yes & \yes \\
|
|
PQ-ready keys & \yes & \no & \no & \no & \no \\
|
|
K8s CRD & \yes & \no & \no & \no & \no \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
\subsection{Performance}
|
|
|
|
Benchmarked on a single 4-vCPU node (AMD EPYC 7R13, 8~GB RAM, PostgreSQL~16):
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{Authentication latency (median / p99, milliseconds).}
|
|
\footnotesize
|
|
\begin{tabular}{@{}lrr@{}}
|
|
\toprule
|
|
System & Median & p99 \\
|
|
\midrule
|
|
Hanzo IAM & 18 & 42 \\
|
|
Auth0 (managed) & 85 & 340 \\
|
|
Clerk (managed) & 62 & 210 \\
|
|
Supabase Auth & 35 & 120 \\
|
|
Firebase Auth & 95 & 450 \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
Auth0 and Clerk latencies include network round-trip to their managed infrastructure. Hanzo IAM runs in-cluster, eliminating this overhead. Supabase Auth is also self-hostable and shows competitive latency; however, it lacks SAML, LDAP, SCIM, and Casbin RBAC.
|
|
|
|
\subsection{Integration Cost}
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{Integration effort for a typical multi-tenant SaaS.}
|
|
\footnotesize
|
|
\begin{tabular}{@{}lrr@{}}
|
|
\toprule
|
|
System & LoC (glue) & Setup time \\
|
|
\midrule
|
|
Hanzo IAM & 45 & 15 min \\
|
|
Auth0 & 180 & 2 hr \\
|
|
Clerk & 120 & 1 hr \\
|
|
Supabase Auth & 90 & 45 min \\
|
|
Firebase Auth & 150 & 1.5 hr \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
Hanzo IAM integration consists of deploying the \texttt{HanzoIAM} CRD and adding a JWT validation middleware to the service. Auth0 requires configuring rules, actions, and custom database connections. Firebase requires installing the Firebase Admin SDK and implementing custom claims logic.
|
|
|
|
\subsection{Total Cost of Ownership}
|
|
|
|
At 100,000 monthly active users (MAU):
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{Monthly cost at 100K MAU (USD).}
|
|
\footnotesize
|
|
\begin{tabular}{@{}lr@{}}
|
|
\toprule
|
|
System & Monthly cost \\
|
|
\midrule
|
|
Hanzo IAM (self-hosted) & \$18 (compute) \\
|
|
Auth0 (B2B Essential) & \$1,300 \\
|
|
Clerk (Pro) & \$500 \\
|
|
Supabase (Pro) & \$25 + \$0.00325/MAU \\
|
|
Firebase (Blaze) & \$0.06/verification \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
\subsection{Key Differentiator}
|
|
|
|
Hanzo IAM is the only identity provider with integrated Casbin policy engines, SCIM~2.0, and post-quantum-ready key derivation (ML-KEM-768 for key encapsulation during session establishment). It runs as a single binary with a Kubernetes CRD for declarative management. No other system offers self-hosted, open-source identity with this breadth of enterprise protocol support.
|
|
|
|
%% ============================================================================
|