Your comments

Another vote for this please :) obviously with a backup URL so if SAML fails we can still get in using an dedicated admin account with a secondary method. SecretServer has a great implementation for this if anyone needs  some inspiration.