We had a couple of issues using SSO; one resolved, the other still an irritation
Auto-provisioning users with alternative access level - base on our use case we needed users auto-provisioned at the "reviewer" access, as opposed to the default "requestor". It took a handful of contacts @ Workfront ...