zlacker

That's very interesting, at $WORK we recently added SAML support in a similar use case, as a SaaS SP integrating with the customer's IdP.

At the time we looked at various open source implementations, and ended up using OneLogin's PHP library. We wanted a headless library, so we could store the SAML metadata in our main DB and implement the public endpoints on top of it.

It did take a few days of googling and trying, but it wasn't really that complicated. Our core implementation adds up to just some 500 lines of PHP, most which is just glue code to fetch metadata from the db, put it in the format the library expects, and then do the basic thing of sending the user to the IdP, getting the response back, checking it, and mapping a couple of attribute names.

The advantage of this approach is that we were able to made it self service for our users. User logs in as admin, goes to "SAML settings", inputs their metadata, clicks a button to test, and if it's good, clicks another to activate. We did get a few support requests from people who didn't know their own systems very well, but otherwise it's working smoothly.