Similar as oauth2Login() loads user from OAuth2UserService interface. SAML attributes need to be retrieved as well.
Comment From: jzheaux
Closing this issue as a duplicate since #8010 heavily overlaps and most of the conversation about this feature appears over there.