Aha, brings back memories. Had to implement SAML login as a Service Provider once - a true abomination of a protocol, will never go near it again, and that was the easier side of things.