BuSSO is a single sign-on service that speaks both SAML 2.0 and OpenID Connect, so services with different authentication expectations share one login.
It carries the access control and the audit trail alongside the authentication, which is what turns a login service into something an administrator can answer questions with.
Problem
An institution accumulates services faster than it standardises them. Each arrives with its own login, its own idea of who a user is, and its own protocol, and the person using them ends up with one identity split across several accounts.
Consolidating the logins is the easy half. The harder half is that the services do not agree on how to ask.
Constraints
The protocol could not be dictated to the service providers. Some speak SAML, some speak OpenID Connect, and a service that already exists is not going to be rewritten to suit the sign-on. So both had to be supported generically, rather than one being supported and the other bridged.
Access to an institutional service is also something that has to be answerable after the fact, not only enforced at the moment of the request.
Approach
Generic SAML and OIDC support, with service provider management so a new service is configured rather than coded.
Access is controlled on two axes: by email, which handles the individual exception, and by role, which handles the rule. Both are needed, because every real access policy is a rule with exceptions.
Two logs, kept apart on purpose: an access log of who reached what, and a data change log of what was altered in the service itself. They answer different questions and would be less useful merged.
Outcome
One login across services that never agreed on a protocol, with a record of who reached what and of what changed.