Gitlab already has several plugins for auth, for example you can use OmniAuth to have users login with an external identity provider: https://docs.gitlab.com/ee/integration/omniauth.html

No extra products needed if they're already using one of those supported providers. OpenID Connect makes things much simpler than traditional SAML unless you need all the extra enterprise provisioning features.