The SAML Federation one is where all the modern SaaS fall short. Its still SAML but it involves:
All the metadata for 100s of IDPs being downloaded and made available to enable
Publishing the SP metadata to the federation(s) which may involve fees.
Specific rules around metadata (attributes) being released and adhered to.
And if your directory insists on having an email addresses for a user, that might be an issue.
There's a reason why Higher Education businesses have cropped up around doing SAML Federation.
I have had a trial of FusionAuth, and it was great, just didn't solve enough of our pain points to justify a migration.
Sounds like the SAML federation is pretty education focused, so maybe FusionAuth isn't a good fit. Maybe something more open source like Shibboleth would help? Seems like a tough spot, hope you find something.
I went to a talk by Heather Flanagan[0] about how the browser third party cookie changes are going to impact the education space, and the education sector does have some special requirements.
I will say that we do sometimes move items on our roadmap around and can prioritize certain features. This requires a customer to commit to contract of a certain size, of course. Our sales people would love to chat if this is you :) .
> Multi-tenant (each of my customers gets a fully separate directory, with access to all tenants for our admins)
Yup.
> SAML and OAuth (customers can set up SAML themselves via the SaaS interface, or we set the SP up for them)
You'd have to build an interface using our APIs for this. Not available out of the box, but we do have it in the general roadmap (https://github.com/fusionauth/fusionauth-issues/issues/91 is the tracking issue).
> Rule based group assignment based on SAML attribute evaluation (e.g. assign users to this group if the attribute X = Y)
You could do this with Lambda HTTP Connect (a paid feature) or webhooks (a free feature. https://fusionauth.io/docs/v1/tech/lambdas/#using-lambda-htt... has more
> APIs to manage users, groups, organisations (tenants)
Yup.
> SAML Federations like InCommon...
Hmmm. We have an open issue for supporting this, but I'm not sure what is involved. If it is straight SAML, it should work, but SAML is pretty ... multi-facted so testing would be needed.