Surely, in practice, you support ADFS and Shibboleth, and then you implement additional support as your clients ask it of you. If you're doing it the Microsoft

Surely, in practice, you support ADFS and Shibboleth, and then you implement additional support as your clients ask it of you. If you're doing it the Microsoft way, you throw up your own instance of ADFS, configure that to authenticate against your clients' SAML IDPs, and authenticate against your own ADFS yourself, thus avoiding having to deal with interop concerns within your own application. Practically everybody can interop with ADFS. On non-Microsoft systems, I believe the likes of OpenAM (or its paid-for version, ForgeRock Access Management) can do this, among other options.