Single sign-on via your agency IdP posts a SAML assertion to /auth/saml. Break-glass local sign-in:
/auth/saml