Comment by paulddraper

ODIC cannot operate with a private-network IdP.

SAML can.

In general, SAML is complicated because (1) auth is complicated (2) XML is complicated (3) canonicalization/signatures are complicated.

Some of those are unforced errors, some are historical facts.