I did some work with SAML last year. Worst period of time ever, makes WSS look nice and clean.
I did a SAML implementation with Ping Identity for a "large kids brand" and it was horrible. Getting permissions and roles out of LDAP, passed through SAML and translating them to our application was so brutal it was laughable.
Guess what happened. 12 months later they dropped everything except the SAML login support and switched back to using our permissions instead.