<single-sign-on domain="..."/> attribute should be required.