security enabled only if sso_enabled