Not the GP, but from my personal experience and exposure to Kerberos and SAML, most customers have a very custom SSO setup, permissioning can be hell (especially if the company did it a long time ago, and they didn't onboard a new SSO-friendly vendor in a long time), and all in all any interaction with the SSO system typically requires long back and forths with IT and other kinds of red tape.

omneity basically hit it on the head.

The core of SCIM/SAML is relatively simple, but there are tons of different ways companies can configure things.

* Younger companies tend to use a "modern" identity provider, Okta, Google Workplace, etc. However, the owner of SSO system doesn't tend to be an SSO expert. These setups normally work "out of the box", but require a bit more generic guidance since the person setting it up only deals with SSO occasionally.

* Older companies have the internal expertise, but often use legacy configurations. Many time, this is just a matter of figuring out what the two different system call various fields. However, the range of errors can be huge, so you have to explore a bunch of stuff.