> I don't know why people say SAML is complex or hard

This is a position only people with deep knowledge of SAML can take. Once you understand it, it’s not so bad. But most people - including experienced engineers with decent knowledge of various authentication protocols - find SAML pretty impenetrable, and many of the people implementing it are doing so by following a series of documented procedures that they do not otherwise understand.

Source: was a PM for the authentication stack on a big enterprise platform and helped countless customers with their SAML confusion.