How to have SimpleSaml create a new account only when the user doesn't have a Drupal account already? I'm new to Simplesaml...I feel like I'm missing something obvious in the configuration. Could someone point me in the right direction?

Drupal - 7.53

simpleSAMLphp Authentication - 7.x-2.0-alpha2
We have this setup running, and it does not register a new user each time but only the first time a user logs in, as expected. I just remember running into problems when unique identifier and user name where set to different values (my old bug report is possibly related).
To further manage the displayed user names you could use Drupal modules like RealName.

configuring SimpleSAMLphp_auth to register new users

In the admin interface, navigate to admin/config/people/simplesamlphp_auth

Under the tabs 

USER PROVISIONING
check - Register users (i.e., auto-provisioning)


and

USER INFO AND SYNCING
Which attribute from simpleSAMLphp should be used as user's name *
eduPersonPrincipalName 


(enter an attribute that uniquely and consistently identifies the user in your realm and that your SAML IdP provides, some attributes change with each invocation and are therefore not suitable, eduPersonPrincipalName is suitable for most educational entities, email could also work fine here) 

Which attribute from simpleSAMLphp should be used as unique identifier for 
the user *
eduPersonPrincipalName


(enter an attribute that uniquely and consistently identifies the user, make sure to use the same attribute as in user's name before) 

From the documentation:


  Determines wether or not the module should automatically
  create/register new Drupal accounts for users that authenticate using
  SimpleSAMLphp. Unless you've done some custom work to provision Drupal
  accounts with the necessary authmap entries you will want this
  checked.


Checking which SAML attributes are available

Navigate to the admin interface of your simplesamlphp install (you might need to activate the interface and look up the password of the install from config.php).
 navigate to the Tab Authentication and "Test configured authentication sources" (/module.php/core/authenticate.php), log in to the same authentication source that is configured in the drupal plug-in under "Autenticaton source for this SP (default: default-sp)" and an overview of all SAML attibutes for that user will be displayed. 

The attributes that can be used are possibly best obtained from the documentation of the identity provider, example: https://www.feide.no/attributelist