I’ve deployed Auth0 in production before (and quickly glanced through gcloud identity). This seems aimed at larger enterprises (both in terms of features and pricing). Imagine an enterprize trying to deploy ldap or active directory in the cloud age and keeping all accounts in sync with various SaaS.

Auth0 can be used that way but with some work. It really shines when you want to build saas that requires user login. Auth0 is worth every penny (priced by active logins) but I’d be hard pressed to spend 4$ per user if I’m building a consumer saas (but 4$ per employee login is reasonable).

Google Identity is not going to be the right solution for integration with other AD/LDAP stores.

Really big companies will often have multiple AD/LDAP identity stores with enterprise grade provisioning systems (Sailpoint, Oracle Identity Manager) to keep accounts in sync.

This offering from Google is meant as a replacement for AD/Exchange(obviously) for companies that are mid-small. It also offers provisioning to other apps but only those that support SAML Just-In-Time provisioning. I did not immediately see a way to add custom apps to this (for provisioning), so might be limited to just the OOTB apps they provide (List: https://support.google.com/cloudidentity/topic/7661972)

Auth0 today offers SAML integrations and if the target system supports JIT Provisioning, it will work the same as google.

And just to clarify, Google's offering is 100% meant for internal users (employees, anyone that you'd give a Google Apps account to)

Didn't Google already have an SSO solution? I'm using it in GSuite at our company. Or was it restricted to only GSuite?

Edit: BTW, I see this can be set up for Github Business. Does github.com not support SAML?

Yes, G-Suite/Google Cloud all use the same system. This is just extracted for companies to use without G-Suite or Google Cloud.

Doesn't that mean it's cheaper to just use GSuite than to use this?

Yes. I don't see a large scenario where a company isn't already using G-Suite or Office 365 and the higher tiers include all the compliance and management features. Usually if they need more customization then they use OneLogin or Okta on top, or build their own system.

GSuite provides less features for identity (it bundles what is now described as the Free Edition of Cloud Identity, while the standalone/add-on product is the Premium Edition.)

This is a Premium Edition, the Free Edition is what is included with GSuite:

https://support.google.com/cloudidentity/answer/7319251

You can "login with Google" on third party sites, but it involves an asking permission screen. The seamless SSO experience only works on Google's own properties.

I'm talking about SAML setup for GSuite.

https://aws.amazon.com/blogs/security/how-to-set-up-federate...