My problem with the SSO providers is not the technical part, thats "easy". Its the coordinate with the 200+ external and internal vendors / support to redeploy the SSO part which is time consuming. I always say its a ~3 year project, which can be done in 6 months with the right amount of resources, especially if the platform has been running for years.