I am looking to create an integration with a SAML app that can be accessed two ways:

1. Named users, i.e., your Okta account name or email is your app user name
2. The app is accessed via a shared, dummy account

When I create two SAML integrations to the same app, one of the integrations (the one whose cert/key match what was uploaded to the app) works, the other fails as the certs don't match.

I could create a single app integration and set a custom username, i.e., if some condition is true then app user name is user.login, otherwise, dummy ID, but I don't want to do that, as I won't have (don't want) something to condition on.

It does not appear that I could assign username based on group membership and I would prefer not to do this anyway, as I want any user to be able to access this app either way, as a "named" user and as a "shared account" user, depending on circumstance.

Any alternate ideas on how to hack this?

Thanks