SAML and IPsec both make my eye twitch, and I too have struggled where the person on the other end has no idea. One of my favourites was the time I was trying

SAML and IPsec both make my eye twitch, and I too have struggled where the person on the other end has no idea. One of my favourites was the time I was trying to figure out a SAML integration with a client, and before the person on the client's "SSO team" could figure it out, I installed a demo of their SSO solution, integrated with my own dev AD, and found the checkbox. Yay enterprise! The Q in enterprise is for quality.