SAML SSO with OAuth2 token exchange.