I'm in a similar situation.

I would like a serverless and distributed solution, that supports: username & password, SSO discovery, SAML 2, federated SAML, OIDC, OAuth2, magic links, permissions, rules for assigning users to groups based on attributes, deletion automation, multi-tenancy and - of course - excellent security and monitoring.

We pay a lot of money to Okta at the moment, and have to use another solution "on top" to support federated SAML.

We'd rather all this be in our own AWS account and globally distributed so personal data never leaves the users country of origin.

Not asking for much surely? </s>