Now that I have 30 odd apps configured, it occurs to me that adding a new employee to our non-shared-login corporate apps still requires 2N+1 transactions:

1. Add the new employee as a OneLogin user. 

2. The first N transactions: For every non-shared-login app that employee might use (a couple dozen for me), I have to login to that app as an admin and create a login for the new employee, granting the appropriate privileges, etc.

3. The second N transactions: Configure those credentials in each corresponding app of the employee's OneLogin user account. 

Similar steps are involved when an employee leaves.  This isn't a big deal for my company yet, but I can foresee it being a win for certain apps used by high turnover employees, like ticketing systems for support techs, that really require non-shared login to work properly.

I know this is about a thousand times harder than just automating login, and OneLogin is extremely nice even without it, but it would completely eliminate the headache involved in handling staffing changes.

The SaaS / web app revolution killed LDAP as the answer for painless employee provisioning.  Maybe you can be the new one!