We are reopening the existing LibertyPASPlugin (
http://plone.org/
products/liberty-authentication-plugin-for-pas) to support SAML2
authentication in Plone, the behaviour should be the same as in OpenID
to ease to federate an existing Plone account with an SAML2 identity.