fix: validate SSO token in SAML user authentication check

Previously, SAML users could bypass password authentication restrictions
by including any sso_auth_token parameter, even invalid ones. Now the
method properly validates SSO tokens against Redis storage before
allowing the bypass, closing the security vulnerability while maintaining
legitimate SSO functionality.

enterprise/app/controllers/enterprise/devise_overrides/sessions_controller.rb

@@ -36,13 +36,13 @@ module Enterprise::DeviseOverrides::SessionsController
   private
 
   def check_saml_user
-    # Skip if using SSO token (SAML users can use SSO tokens)
-    return if params[:sso_auth_token].present?
     return if params[:email].blank?
 
     user = User.from_email(params[:email])
     return unless user&.provider == 'saml'
 
+    return if params[:sso_auth_token].present? && user.valid_sso_auth_token?(params[:sso_auth_token])
+
     raise CustomExceptions::Base.new(I18n.t('messages.login_saml_user'), :unauthorized)
   end
 end