I implemented a SAML2 IDP once when I worked at a University using Shibboleth (as both the IDP and SP).<p>SAML2 has a lot of heavy usage in academia or between industry systems. That being said, there were a lot of exceptions and rules that needed to be put into place for the plethora of broken SAML2 implementations. Some needed an attribute in two scopes, others had trouble with certain OIDs, etc. The Shibboleth mailing list is filled with things like, &quot;oh if you&#x27;re trying to connect to someone using Oracle SSO, add x y and z because their stuff is hopelessly broken.&quot;<p>I mean for the most part, it did just work. I see it as great when you want to build trust relationships, but in the general case, I think OpenID was simpler and better.<p>I still run my own OpenID. It gets me into ... StackExchange. It no longer works with Slashdot, gitorious, freecode and many other sites that have either stopped supporting it or gone under. Oh wait, it works with OpenStreetMaps too.