A company is implementing a launchpad within an existing application that will point to an existing SaaS provider. One of the requirements is the user should not have to log on multiple times. SSO…

If users did not exist within the SaaS provider, they would receive an access denied or unknown-account error after the SSO assertion, not a standard login credentials prompt.

Incorrect group permissions would cause an authorization failure after successful authentication completes, not a login prompt before access is granted.

If users did not exist in directory services, SSO authentication would fail entirely at the identity provider level and users could not reach the launchpad redirect at all.

Federation is the mechanism - typically SAML or OIDC - that allows an identity provider to assert a user's authenticated identity to a SaaS provider through a trusted relationship. If that federation trust is broken due to misconfigured metadata, expired signing certificates, or an untrusted assertion, the SaaS provider cannot validate the SSO token and falls back to prompting for credentials. Since SSO is confirmed active and the launchpad redirect functions correctly, a failing federation is the most precise explanation for re-authentication occurring specifically at the SaaS boundary.