add "sso" resource-id, set autoaproved to "tonr"