[pas]

SSO is fine, but verify the email address that the SSO provider has given (unless the provider is authoritative for the email domain)