As someone who has been the primary support person for SSO, I’ve come to find the tax absolutely necessary.

It accounted for well over half of our company’s support tickets. The biggest problem is nobody on the customer end wants to champion getting it setup. When things go wrong, they just throw their hands up.

What can go wrong? What are common issues?

Not the GP, but from my personal experience and exposure to Kerberos and SAML, most customers have a very custom SSO setup, permissioning can be hell (especially if the company did it a long time ago, and they didn't onboard a new SSO-friendly vendor in a long time), and all in all any interaction with the SSO system typically requires long back and forths with IT and other kinds of red tape.

omneity basically hit it on the head.

The core of SCIM/SAML is relatively simple, but there are tons of different ways companies can configure things.

* Younger companies tend to use a "modern" identity provider, Okta, Google Workplace, etc. However, the owner of SSO system doesn't tend to be an SSO expert. These setups normally work "out of the box", but require a bit more generic guidance since the person setting it up only deals with SSO occasionally.

* Older companies have the internal expertise, but often use legacy configurations. Many time, this is just a matter of figuring out what the two different system call various fields. However, the range of errors can be huge, so you have to explore a bunch of stuff.

Don’t be shy, here’s the link: https://github.com/robchahin/sso-wall-of-shame/issues.

There is a better ssotax.org which is more up2date and has even a Friends of SSO page.