Hacker News Reader

You could integrate with something like Ping Federate. Then customers configure their identity provider to connect to your Ping Federate instance. I've seen the workflow for the support team to enable customers and it's not terribly difficult with the usual issues around expired certificates. Weird customers can be outsourced to Ping Federate support for guidance.

If an IdP is SAML compliant, you only need to write code once. Of course, if you also want to authz based on IdP roles, you will need to have a mapper (from your app perms to IdP roles), but this is not because of differences in IdP

SAML in my (anecdotal) experience seems to be worse, if it's supported at all.

Most IdPs support SAML IIRC

We've been quite happy with Auth0 to solve this problem.

Auth0 is just another IDP, no? Could you elaborate?

Auth0 can be used as the SP as well.

https://auth0.com/docs/authenticate/protocols/saml/saml-sso-...

SAML delenda est