diff --git a/spec/controllers/devise/session_controller_spec.rb b/spec/controllers/devise/session_controller_spec.rb
index f9c2ad1fd..f495812de 100644
--- a/spec/controllers/devise/session_controller_spec.rb
+++ b/spec/controllers/devise/session_controller_spec.rb
@@ -93,4 +93,58 @@ RSpec.describe 'Session', type: :request do
       expect(response).to redirect_to(%r{/app/login\?error=access-denied$})
     end
   end
+
+  describe 'SAML user authentication' do
+    let!(:account) { create(:account) }
+
+    context 'with SAML user' do
+      let!(:saml_user) { create(:user, email: 'saml@example.com', provider: 'saml', password: 'Password123!', account: account) }
+      let(:saml_settings) { create(:account_saml_settings, account: account, enabled: true) }
+
+      before do
+        saml_settings
+      end
+
+      it 'blocks password login' do
+        post new_user_session_url,
+             params: { email: saml_user.email, password: 'Password123!' },
+             as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.headers['access-token']).to be_blank
+      end
+
+      it 'returns proper error message' do
+        post new_user_session_url,
+             params: { email: saml_user.email, password: 'Password123!' },
+             as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.body).to include('Invalid login credentials')
+      end
+
+      context 'with SSO token' do
+        it 'allows login via SSO token' do
+          sso_token = saml_user.generate_sso_auth_token
+
+          post new_user_session_url,
+               params: { email: saml_user.email, sso_auth_token: sso_token },
+               as: :json
+
+          expect(response).to have_http_status(:ok)
+          expect(response.headers['access-token']).to be_present
+        end
+      end
+    end
+
+    context 'with blank email' do
+      it 'allows the request to proceed normally' do
+        post new_user_session_url,
+             params: { email: '', password: 'somepassword' },
+             as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+  end
 end
diff --git a/spec/controllers/devise_overrides/sessions_controller_spec.rb b/spec/controllers/devise_overrides/sessions_controller_spec.rb
deleted file mode 100644
index b69e6c967..000000000
--- a/spec/controllers/devise_overrides/sessions_controller_spec.rb
+++ /dev/null
@@ -1,83 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe 'DeviseOverrides::SessionsController', type: :request do
-  let(:account) { create(:account) }
-
-  describe 'POST /auth/sign_in' do
-    context 'with regular user' do
-      let!(:user) { create(:user, email: 'regular@example.com', password: 'Password123!') }
-
-      it 'allows password login' do
-        post '/auth/sign_in', params: {
-          email: user.email,
-          password: 'Password123!'
-        }
-
-        expect(response).to have_http_status(:ok)
-        expect(response.headers['access-token']).to be_present
-      end
-    end
-
-    context 'with SAML user' do
-      let!(:saml_user) { create(:user, email: 'saml@example.com', provider: 'saml', password: 'Password123!') }
-
-      it 'blocks password login' do
-        post '/auth/sign_in', params: {
-          email: saml_user.email,
-          password: 'Password123!'
-        }
-
-        expect(response).to have_http_status(:unauthorized)
-        expect(response.headers['access-token']).to be_blank
-      end
-
-      it 'returns proper error message' do
-        post '/auth/sign_in', params: {
-          email: saml_user.email,
-          password: 'Password123!'
-        }
-
-        expect(response).to have_http_status(:unauthorized)
-        response_body = response.parsed_body
-        expect(response_body['success']).to be false
-        expect(response_body['errors']).to include(I18n.t('messages.login_saml_user'))
-      end
-
-      context 'with SSO token' do
-        it 'allows login via SSO token' do
-          sso_token = saml_user.generate_sso_auth_token
-
-          post '/auth/sign_in', params: {
-            email: saml_user.email,
-            sso_auth_token: sso_token
-          }
-
-          expect(response).to have_http_status(:ok)
-          expect(response.headers['access-token']).to be_present
-        end
-      end
-    end
-
-    context 'with invalid credentials' do
-      it 'returns unauthorized error' do
-        post '/auth/sign_in', params: {
-          email: 'invalid@example.com',
-          password: 'wrongpassword'
-        }
-
-        expect(response).to have_http_status(:unauthorized)
-      end
-    end
-
-    context 'with blank email' do
-      it 'allows the request to proceed normally' do
-        post '/auth/sign_in', params: {
-          email: '',
-          password: 'somepassword'
-        }
-
-        expect(response).to have_http_status(:unauthorized)
-      end
-    end
-  end
-end