You can use an identity broker like https://fusionauth.io/ (disclosure, I work for them) to ease the pain. We put a dev friendly wrapper over SAML connections, among other functionality.

Here's our IdP docs: https://fusionauth.io/docs/v1/tech/samlv2/

Here's our SP docs: https://fusionauth.io/docs/v1/tech/identity-providers/samlv2...

That's exactly why we built WorkOS. It's like "Stripe for SSO/SAML."

Shameless plug for my startup. Hope that's still ok on HN :)

https://workos.com/

This sits between a company’s ActiveDirectory and something like Okta? Or is it more like Sail Point that lets you write logic to link everything up?

It’s infrastructure for SaaS apps to easily connect to all the different systems used in the enterprise, including Okta, OneLogin, ActiveDirectory, Workday, etc.

Probably a dumb question, everything in my sphere is active directory - why would you have more than one identity provider?

Workday: HR system of record, source of truth on which accounts should be provisioned and deprovisioned in AD.

Active Directory: holds those accounts.

Okta/OneLogin: facilitates use of AD accounts to log in to webapps.

Ah thanks, I thought he meant they were all being used as identity providers - this makes more sense

If you’re a developer building an app, your customers use a variety of different systems. These are fragmented and you need to support all of them, not just Active Directory.

The previous post said "the enterprise" which makes me think of a singular organisation using all of them - maybe I'm misunderstanding, but why would a single org use more than one?

"The enterprise" is jargon for "the enterprise market."

It's rare that a company will use multiple identity systems, but there exists lots of fragmentation across the large companies, which makes building a universal solution into your app very time consuming.