Use the most battle-tested, well-supported SAML service available, even if it's more pain up-front; something that documents what XML canonicalization and signa

Use the most battle-tested, well-supported SAML service available, even if it's more pain up-front; something that documents what XML canonicalization and signature algorithms and crypto suites it supports, so you're not dead in the water upon encountering a federation partner that requires encryption, or claims filtering and transformation, or whatever. The federation service should live outside your app(s); app(s) trusts your fed server only, and the fed server manages trust relationships with third parties, handles stuff like claims mapping; apps should be architected to understand that user information has been somehow added to the request context, but isolated from the mechanism, and ideally not expect to have an external source of user state. Get comfortable with the protocol over HTTP; capture the exchanges, decode the payloads.