Does this still work if folks are authenticated via federation/SAML instead of as IAM users?