A better description would be that it iterates over legacy SSO handlers, and pre-authenticates a user if a handler returns one.

Bonus: could we maybe log something if an SSO handler actually matches ? Would be useful for developers.