As the founder of FusionAuth (<a href="https://fusionauth.io" rel="nofollow">https://fusionauth.io</a>), let me relay 5 years of experience in building our platform in bullet points (not exhaustive by any means, but a rough overview). Also note that these aren't all authentication related, but once you build your own authentication, most everything else has to be done by hand as well:<p>- OAuth 2 IdP and SP federation plus theming<p>- SAML v2 IdP and SP federation<p>- Nested federation (i.e. OAuth to SAML to OAuth to another OAuth)<p>- JWTs (issuing, validation, introspect, user_info, numerous certificate and key-pair concerns, reconciliation, introspection)<p>- Refresh tokens (managing, revoking, exchanging, securing, and more)<p>- Lambdas to handle claim mapping and JWT population plus all the security around sandboxing JavaScript so it isn't an attack vector<p>- Key management<p>- Certificate management<p>- User indexing and searching (when you have 100+ million users, this isn't easy)<p>- Password rules (HIPAA, PCI, SOC, ISO, NIST)<p>- Breached password detection (Have I been Pwnd style)<p>- Password hashing (making it configurable, changeable, upgradeable, etc)<p>- Devices (trust, OAuth Device Grant, MFA, passwordless)<p>- Threat modeling and detection<p>- Brute force prevention<p>- Account locking<p>- Event management (login, account creation, deletion, etc)<p>- CORS<p>- CSRF<p>- XSS<p>- Injection attacks (JS, SQL, etc)<p>- Privilege escalation attacks (tunnels, backdoors, script injection, etc)<p>- Replay attacks<p>- JWT header attacks<p>- Click-jacking attacks<p>- IFraming<p>- CVE management (libraries, OS, database, frameworks, APIs, etc)<p>- MFA (authentication apps and SMS)<p>- TOTP<p>- MITM and spoofing<p>- HSTS<p>- Passwordless logins<p>- Network management (firewalls, public and private access, intrusion detection, logging, auditing)<p>- Pen tests (i.e. these aren't cheap)<p>- Compliance (also not cheap and very time consuming)<p>- Family management (multiple parents, divorces, multiple kids, roles, ages, consents)<p>- Consent modeling (CCPA, GDPR, and many more are coming)<p>- Group management<p>- Roles and permissions<p>- All the email things (forgot password, passwordless, email verification, templates, localization)<p>- Reporting (DAU, MAU, etc)<p>Every line of code, every API, every HTML page, every button click, every form submit, every layer, every network hop, every operating system, every third-party tool, every library, and every browser must be secured and tested. If you have a big team and a lot of free time, you can probably get something workable that is secure in a year or two.<p>Of course, YMMV. ;)<p>Or like other folks have said, you can always use FusionAuth, Keycloak and others. They are all free and do all of this already. Though, I'd be suspicious with some projects. The compliance, auditing and testing pieces are expensive and probably not something they do much of.<p>And who knows what is going on with IBM and RedHat. I'd run screaming from that disaster if I were you. :)