Optional Flag to Allow SSO Identity Linking

Summary Add an optional configuration flag that allows SSO identities to link to existing accounts based on email matching, the same way OAuth providers already work. The Problem When users log in via SAML SSO, they always get a new account - even if they already have an account with the same verified email. This forces me to either: 1. Accept duplicate accounts (bad UX, data fragmentation) 2. Build a custom migration flow in my application (significant engineering effort) 3. Manually merge accounts via Admin API (doesn't scale) I Understand the Security Reasoning I'm aware that SSO identity isolation was implemented intentionally for security purposes - you can't blindly trust that an IdP has verified email ownership. I'm not asking to change the default behavior. I'm asking for an opt-in flag for cases where I: • Verify the IdP is legitimate (e.g., after confirming with my customer that it's their real corporate IdP) ̶…