We primarily use SAML authentication (with Google as our identity provider) to get people into Populi. However, we periodically have the need to grant people normal Populi usernames and passwords. For example, people from outside the school audit courses, or students from a nearby partner school take classes here for transfer credit, or students who withdraw have their school e-mail shut down but may still need to get to Populi for financial/academic records.
For this group, giving them school e-mail accounts is either unfeasible or inappropriate, and using the ?sso=0 bypass link is terribly inconvenient. Any automatically generated e-mails they get from Populi that also include links back to Populi (e.g. registration e-mails) try to route them through the normal SSO login if they aren't already authenticated. They have to go to the SSO bypass link first and login before those links will work.
What would be nice is a login page that has the standard username/password fields as well as a SAML SSO button. For example, we use ConnectWise Control for remote IT support and this is what their login screen looks like with SSO enabled:
Staff click the button at the bottom (the text of which we can set to whatever we want) which takes them to the Google SAML authentication page. But we have outside contractors with access to specific PCs, and we don't want them to have e-mail accounts with our organization. So they just have standard credentials that they login with above.
Yes, it does add one extra mouse click for SSO users, but that is a worthy tradeoff, IMO.
