More work on SAML SSO