Affects
Teams that configure Access Manager SSO in a multi-tenant deployment.
What changed
Before issuing tokens, Auth validates that the email returned by the identity provider resolves to the tenant that initiated the SSO flow. A missing email or an email that resolves to another tenant is rejected with the generic SSO failure response. This is a documentation correction that records implemented behavior. It does not announce a runtime release.
Impact
Classification: Action required. An identity provider that omits the email claim or returns an address for another tenant will not complete SSO login.
What you need to do
1
Verify that your identity provider returns an email for every SSO identity.
2
Confirm that each returned email resolves to the tenant that initiated the login.
3
Test the SSO callback flow for each configured tenant before the next production change.