So, when management tells us our website needs to "support SSO through SAML 2.0", with no additional details, what are they thinking?

What will our customers expect?

Note - The is not an open website, where everyone can join. To log in you need to be a configured user in the system. The customer's admins need to create an account in our system for each user.

So we aren't going to let just anyone who has an account with an IdP in to our website. We'll have to have some mechanism for mapping a SAML identity to our users.

How would our customers expect that to work?