Are there any costs associated with using SAML single-sign on with Salesforce?
Are there any limits with number of calls on a daily basis?
[SalesForce] Cost associated with Single sign on
Related Solutions
In the org, go to Setup | Security Controls | Single Sign-On Settings and click the SAML Assertion Validator button. If the SSO attempt got as far as your org, you should see something there that will lead you towards identifying the problem.
If there is nothing listed in the SAML Assertion Validator, then Salesforce is not able to identify the correct org from the assertion. Go into the OpenSSO logs, copy the SAML assertion, and paste it into the SAML Assertion Validator. Again, this should lead you towards resolution.
I'm happy to say that this feature is now fully accessible to administrators. It has been possible to prevent users from using their Salesforce credentials when they were SSO-enabled but it required contacting Salesforce support.
As of Summer '20 (release notes), you can configure SSO in a way that it prevents users from using their internal credentials.
Best Answer
There are no costs associated with SSO from Salesforce. Any licenses that have unlimited logins have unlimited SSO logins as well. Licenses with limited logins share those limits with normal logins.
SAML does impose some additional limitations, so there might be some out of pocket costs. For example, during our implementation, we found we needed a public SSL certificate to support SAML, so we had to pay our CA for a signed certificate for a DNS entry that's not even accessible outside our internal network.
Assuming you have the appropriate hardware and software already in place, the implementation might be completely free or could cost thousands of dollars if you need to build an entire new infrastructure to support SSO.