Not to discourage usage of SAML, but in the past i switched from SAML to OpenID-Connect.
Been using it after there were some issues with SAML/mod_auth_mellon, and i found OIDC easyer to implement compared to SAML.
…And it gives the same functionality on RAW.
Still using it at current on both 2.3.0p35 CRE, as well as a 2.4.0p4 testbox.
So if you have the possibility, investigate OIDC: mod_auth_openidc
The howto ( and related stuff is posted in: This forumpost )
- Glowsome