Comment by paxys

Trusting Lenovo as an auth provider is certainly a decision..

Handling SSO related security-holes in SaaS apps has made up a major chunk of my career at this point.

The most common one – app adds SAML-based login and treats the returned email from the SSO provider as authoritative. What the developers don’t realize is that you can set up your own tenant with most major SSO providers and assign users any arbitrary email – no verification needed.

And if an account with the same email address already exists in your system – congrats, you have just granted full access to it to basically anyone.