I have done that exactly thing, and its impossible to get support from VMWare (just spent an hour on hold before giving up). I think the thing to do is to create a basic auth account with an email address which will not be in SAML, then you'll be able to get back in if SAML dies.