Summary

Once an admin has configured a SAML setting, it applies to all users on their domains. Instantly.
This makes it really tricky for an admin to either test their configuration, or run a "sandpit" IdP instance.

Like many IT tools, big customers will have a "dev" instance of their IdP for testing stuff, and then the "prod" instance of their IdP. Our current SAML setup has no way of incrementally testing a SAML config for a customer. It's all or nothing.

Suggestions

• Run a test login as part of configuration
• Have a "enable" or "test' flag