Gatepost
Scheduled Sep 11, 2026Single sign-on you run, on keys you hold.
Replaces
- Okta Workforce Identity · Okta, Inc. — $14 per seat per month (Workforce Identity Core Essentials), about $67,200/yr at 400 seats
- Microsoft Entra ID P2 · Microsoft Corporation — $10 per seat per month (Microsoft Entra ID P2), about $48,000/yr at 400 seats
Rented, per year
$67,200
Okta Workforce Identity list price at 400 seats.
Owned, per year
$11,760
AWS infrastructure only. Azure is $12,720.
Build
14 weeks
3 engineers. To parity on the ten core features above, including OpenID Foundation conformance certification, migration of 60 application integrations, and a phased cutover running Gatepost as a federated upstream to the incumbent before reversing the direction.
Difficulty
5/5
Among the hardest in Techtons. Read the parity table closely.
Reference organisation: 8,000 employees, ~400,000 token issuances/day, 60 connected applications, multi-AZ, prod + non-prod. 3-year Compute Savings Plan on Fargate, 3-year reservation on Container Apps and PostgreSQL Flexible Server. AWS figure includes KMS signing at the stated token volume; Azure figure assumes Key Vault Premium, not Managed HSM, which would add roughly $2,300/month. Excludes vendor support plans and SIEM ingestion charges. Figures are infrastructure only and exclude the build.
What it is
Gatepost is a workforce identity provider: OIDC and SAML single sign-on, a user directory with group and attribute management, multi-factor authentication including WebAuthn passkeys, and adaptive access policy that evaluates device, network, location and behaviour at every authentication. It is for organisations of 2,000 to 30,000 employees paying $10 to $14 per user per month for what is, at bottom, a token signer and a policy engine. Gatepost runs in your account, signs with keys in your own KMS, and never puts a third party in the critical path of every login your company performs.
Why this one stops making sense
- Okta Core Essentials is $14 per user per month. At 8,000 employees that is $1.34 million a year to issue tokens.
- Entra ID P2 is $10 per user per month, and most organisations buy it for conditional access and identity protection while using a fraction of the rest.
- Your identity provider is the single most consequential dependency you have. When it has an outage, nobody works, and you have no lever except a status page.
- Authentication logs are the highest-value security telemetry in the business, and per-seat platforms meter their retention and their export.
- Adaptive policy is business logic about who may access what from where. Owning it means it is reviewed, tested and rolled back like any other production code.
What ships
- OIDC and OAuth 2.1 authorisation server with PKCE, plus SAML 2.0 for legacy service providers
- User directory with custom attributes, groups, dynamic group rules and delegated administration
- WebAuthn passkeys as the primary factor, with TOTP and push as fallbacks
- Adaptive access policy evaluating device posture, network zone, geo-velocity and session risk
- Step-up authentication driven by ACR and AMR claims that applications can request per operation
- Passwordless and device-bound session flows, with a policy-controlled password path for legacy apps
- SCIM 2.0 outbound provisioning to downstream applications
- Session management: concurrent session limits, forced re-authentication and universal logout
- Authentication event stream to your SIEM in near real time, with full retention under your control
- Break-glass local administration that works when the upstream directory does not
Data model
Stack
- frontend
- Next.js 15 App Router + Tailwind for the admin console; the hosted login page is server-rendered with no third-party JavaScript at all
- backend
- NestJS on Node 22 implementing the OIDC and SAML endpoints, with the policy evaluator as an in-process WASM sandbox
- database
- PostgreSQL 16 with Row Level Security, partitioned authentication event tables
- cache
- Redis 7 for session state, authorisation codes, replay prevention and rate limiting
- queue
- BullMQ for SCIM outbound provisioning, event streaming to the SIEM and enrolment notifications
- auth
- Gatepost is the auth. It federates upstream to Active Directory or an existing IdP during migration and then stands alone
- search
- PostgreSQL tsvector across users, groups and applications
- ai
- Optional anomaly scoring on authentication patterns through an LLM gateway, advisory only and never in the block path
Parity, honestly
What we match, and what we do not.
The rows marked No are the important ones. If one of them is the reason you bought Okta Workforce Identity, keep buying it — and we will tell you that on the first call rather than the fifth month.
| Capability | Okta Workforce Identity | Ours | Note |
|---|---|---|---|
| OIDC, OAuth 2.1 and SAML 2.0 single sign-on | Yes | Yes | Certified against the OpenID Foundation conformance suite as part of the build. |
| WebAuthn passkeys and hardware security keys | Yes | Yes | — |
| Adaptive access policy on device, network, location and risk | Yes | Yes | Policies are code, versioned and diffable, with a dry-run mode that logs what would have been blocked. |
| SCIM 2.0 outbound provisioning | Yes | Yes | — |
| Directory with dynamic groups and custom attributes | Yes | Yes | — |
| Session management and universal logout | Yes | Yes | — |
| Signing keys the customer holds and can rotate on demand | No | Yes | Private keys live in your KMS or Managed HSM and never exist in application memory. |
| Catalogue of 7,000+ pre-integrated SaaS applications | Yes | No | The Okta Integration Network is a genuine asset: thousands of app configurations, provisioning schemas and SAML templates maintained against vendor changes. Gatepost ships generic OIDC and SAML plus templates for your top twenty apps. Everything else is configured by hand once. |
| Cross-customer threat intelligence and password-spray detection | Yes | No | Okta ThreatInsight and Entra Identity Protection see attack patterns across millions of tenants before they reach you. Gatepost sees only your own traffic. That signal cannot be replicated by owning the software, and for some threat models it is the reason to keep buying. |
| Legacy protocol support: RADIUS, LDAP, Kerberos, header-based SSO | Yes | Partial | Gatepost ships an LDAP and RADIUS bridge. Kerberos constrained delegation to on-prem applications is a separate scope. |
| Vendor-run FedRAMP High authorisation | Yes | No | Okta and Entra hold authorisations Gatepost cannot inherit. If your identity provider must be FedRAMP High, this is not the product for you. |
| Authentication log retention and export | Partial | Yes | Every event, kept as long as you want, streamed to your SIEM without a retention upgrade. |
| Uptime backed by a vendor SLA with credits | Yes | Partial | Under a Conseiltek Run agreement we carry the SLA. After handover, availability is your own operational responsibility, and for an IdP that is a serious commitment. |
Reference architecture
Built twice, on purpose.
Every application in Techtons ships with a production architecture for AWS and one for Azure, using the same diagram grammar so you can read them side by side. Your cloud, your account, your bill.
Amazon Web Services
- Compute
- ECS Fargate services (idp, admin, worker) behind an ALB, with the idp service isolated in its own security group and its own task role
- Data
- Aurora PostgreSQL Multi-AZ, ElastiCache Redis with encryption in transit and at rest
- Storage and edge
- S3 for exported event archives, CloudFront for the login page's static assets only
- Identity
- Gatepost is the identity system. AWS IAM Identity Center federates to it, not the other way round
- Observability
- OpenTelemetry to CloudWatch and X-Ray, with authentication latency at p99 as the primary SLO
- Infrastructure as code
- Terraform, one module per environment, remote state in S3 with a DynamoDB lock
Services
The decision worth arguing about
The non-obvious decision is holding the token signing key in KMS as an asymmetric RSA key and calling KMS Sign for every token, instead of loading a private key into the process and signing locally. Local signing is roughly 200 microseconds; a KMS Sign call is 6 to 10 milliseconds and costs $0.03 per 10,000 requests. At 8,000 employees issuing perhaps 400,000 tokens a day that is about $36 a month and 10ms added to a path users feel. We take it, because the alternative means the private key exists in application memory, in a container image layer or in an environment variable, and an identity provider whose signing key can be read by anyone who gets code execution is not an identity provider. The mitigation is architectural rather than cryptographic: access tokens are issued with a 15-minute lifetime and refresh happens on a background timer, so the signing call sits off the interactive path for everything except the initial login. Refresh tokens are opaque and validated against Redis, which needs no signature at all.
Microsoft Azure
- Compute
- Azure Container Apps (idp, admin, worker) with the idp app on a dedicated workload profile rather than the consumption plan
- Data
- Azure Database for PostgreSQL Flexible Server zone-redundant HA, Azure Cache for Redis
- Storage and edge
- Blob Storage for exported event archives, Front Door Standard with WAF in front of the login endpoint
- Identity
- Gatepost is the identity system; Entra ID is federated as an upstream source during migration and can be retired after
- Observability
- Azure Monitor with Application Insights, authentication events to Event Hubs for SIEM ingestion
- Infrastructure as code
- Bicep in an azd-compatible layout
Services
The decision worth arguing about
Azure forces a decision AWS lets you defer: where the signing key lives. Key Vault Premium gives you FIPS 140-2 Level 2 HSM-backed keys at about $1 per key per month plus $0.15 per 10,000 operations, and Managed HSM gives you a single-tenant FIPS 140-2 Level 3 pool with an exclusive key boundary — but Managed HSM bills for two provisioned HSM instances whether you sign once a day or a million times, roughly $3.20 an hour, or about $2,300 a month. For an identity provider that is not obviously wrong; it is the difference between a shared HSM partition and one only your tenancy can address, and some regulators care about exactly that. Our default is Key Vault Premium, with the Bicep exposing a single flag to move to Managed HSM. The reason to default down is that a $2,300 monthly floor for key custody exceeds the entire rest of Gatepost's infrastructure bill, and a customer should choose to spend it deliberately rather than inherit it from a template.
Sources
Every price on this page, with the page we read it from and the date we read it.
| Product | Plan | List price | Checked | Source |
|---|---|---|---|---|
| Okta Workforce Identity | Workforce Identity Core Essentials | $14 / seat/month | 2026-09-05 | www.okta.com/pricing/ Core Essentials bundles SSO, Universal Directory, Adaptive MFA and Lifecycle Management. Okta requires a $1,500 annual contract minimum. The Starter Suite without adaptive policy is $6 per user per month. |
| Microsoft Entra ID P2 | Microsoft Entra ID P2 | $10 / seat/month | 2026-09-05 | www.microsoft.com/en-us/security/business/mi Priced per user per month on an annual commitment. Entra ID P1 is $7 and the Entra Suite is $12. |
Should you still be paying for Okta Workforce Identity?
Two weeks, fixed price. We audit what you actually use, map it against Gatepost, cost the replacement on your own AWS or Azure account, and give you a delivery plan. If the honest answer is to keep the licence, that is what the report will say.