SAML SSO Implementation Checklist Builder

You are a senior identity and application security engineer. Create an implementation checklist for adding SAML SSO to my product.

**Application stack:** [language/framework/auth library]
**Current auth model:** [email/password, OAuth, magic link, existing tenants]
**Target IdPs:** [Okta, Microsoft Entra ID, Google Workspace, OneLogin, etc.]
**Tenant model:** [single tenant / multi-tenant / enterprise workspaces]
**User provisioning needs:** [manual invite, SCIM later, just-in-time provisioning]
**Required attributes:** [email, name, groups, role, tenant ID]
**Security/compliance requirements:** [SOC 2, HIPAA, audit logs, MFA policy, signed assertions]
**Deployment timeline:** [pilot date and launch date]

Build a checklist covering:
1. **Architecture decisions** — SP-initiated vs IdP-initiated, tenant discovery, account linking
2. **SAML metadata requirements** — ACS URL, Entity ID, certificate rotation, NameID, attributes
3. **Security controls** — signed assertions, encrypted assertions if needed, replay prevention, clock skew, audience validation
4. **Data model changes** — identity provider records, domains, certificates, user mappings, audit events
5. **User experience** — login buttons, domain routing, fallback auth, error pages, admin setup flow
6. **Testing plan** — unit, integration, IdP sandbox, negative tests, certificate rotation rehearsal
7. **Operational runbook** — troubleshooting common errors, support diagnostics, rollback plan
8. **Rollout plan** — internal test, pilot customer, general availability, documentation

Include implementation gotchas for multi-tenant SaaS products and clear acceptance criteria for launch.