Grow Membership, Not Your Identity Costs
One member, three logins, one growing problem
We build identity platform for associations, and this post is most relevant for the membership or IT lead who recognizes this pattern: one member, three applications, three separate logins. A continuing-education platform, a membership site, and event registration each kept their own account for the same person. Members hit a login wall every time they moved between services they experienced as one organization. Staff provisioned every new account by hand, so a membership approval in one system never created access in the others.
That split had a cost beyond annoyance. The association had no single answer to who a member was and what they were entitled to, because member identity lived in as many places as there were applications. Every new member-facing service meant another account silo, or another integration built from scratch.
The licensing model works against your growth
Before building anything, we evaluate a hosted identity platform first, because for most organizations that is the right call. A commercial provider brings mature protocol support, a compliance postures an auditor recognizes, and a vendor on call at 2am. For an association whose goal is to grow membership, though, per-user or per-active-user pricing works against the mission: every successful membership drive raises the bill.
There is a second worry that comes up in nearly every conversation with a small internal IT team: what happens if the people who built this move on, or the codebase turns into something nobody can maintain. It is a fair question, and it is one reason we build on published standards rather than anything proprietary. OAuth 2.0 and OpenID Connect are specifications with mature, well-maintained open-source libraries. The cryptography, token signing, and signature handling are solved problems in those libraries. What is left is integration work you would pay for under either option, license or build.
What we built: one login, owned outright
We built a standards-compliant identity server using OAuth 2.0 and OpenID Connect, with role-based access control set by member tier and integrated with the association’s existing member database. A member signs in once and moves between applications without seeing a second login form. Applications never see a password; they receive a signed token and a verified member profile.
The build took 4 to 8 weeks as a one-time project. There is no recurring licensing, and the association owns the codebase outright, including the right to extend it however membership needs change.
Adding a second protocol without renegotiating a license
The real test of owning identity infrastructure came later, when a partner platform needed to authenticate members over SAML 2.0, a different protocol from the OpenID Connect the system already ran. On a per-user licensed platform, a second protocol and a new federated connection typically shows up on the invoice, as a plan tier, a per-connection charge, or both.
Here it was a development work against code the association already owned, not a contract renegotiation. A streamlined process for Members and they noticed nothing: the same login page, the same account, the same session. Someone already signed in to one application reached the new partner without a second login screen. That is what best user experience and owning the identity layer buys you: the next protocol is an engineering decision, not a procurement one.
What it cost, and what it grew into
The build came in roughly 60% lower than the licensed alternative, as a one-time cost with no per-member fee after delivery. That gap is the smaller part of the story. The larger part is what happened after: a licensed platform renews every year and charges more as membership grows, while a built platform’s cost is largely spent once.
Since launch, the association’s user base has grown roughly five times beyond what the system was originally scoped for, running on the same platform at that same one-time cost, with no added per-seat licensing. Published enterprise SSO pricing runs $3 to $8 per user per year based on number of users, so the cost of licensing identity management climbs with every member added, while the cost of owning it does not. We do not publish the dollar figure this specific association would have paid under a licensed model, because that number is derived from member counts that belong to the client, not to us. The direction of the curve is the point: one line goes up with growth, the other stays flat.
Frequently asked questions
How is this different from using Okta or another hosted identity provider?
A hosted provider is often the right call for an association who needs to support small number of members, and we say so to clients directly. The difference shows up in the pricing model: hosted platforms charge per user or per active user, so the bill grows with every successful membership drive. A built system is spent largely once.
What happens to our member data? It stays in the association’s own database. Applications receive a signed token and a verified profile at sign-in; they never hold a copy of member data or see a password.
Can a small IT team maintain something like this? The system runs on published standards, OAuth 2.0, OpenID Connect, and SAML 2.0, using long-standing open-source libraries rather than proprietary code. It publishes a discovery document so new applications integrate with off-the-shelf libraries instead of a custom SDK.
What if we need to add another partner or protocol later? It becomes a configuration record or a development task against code you already own, rather than a new license tier or a renegotiated contract.
Who built this? Profusion Systems, an Azure-based AI-enabled software development firm in Chicago. More on our approach.
Key takeaways
- A custom identity server replaced three separate logins with one account and one session
- The build came in roughly 60% lower than the licensed alternative, as a one-time cost with no per-member fee
- Adding SAML 2.0 for a new partner protocol was a development task, not a contract renegotiation
- Members and guest users have grown roughly five times beyond the original scope, at the same one-time cost, with no added licensing
If you are scoping something like this, reach us at info@profusionsystems.com.