I hate that with passion. Though I don't know the technical reason behind this workflow.
If the user is configured to use SSO it can redirect to the identity provider. If it’s password auth it can ask for the password, etc.
If you type in bob@sso.com for your SSO account, the password field will clearly be a throwaway, and you'll be redirected to your IDP.
Being presented with a "wrong password" error would mean the account is local.
But I'd argue this is a different issue than the one of giving out what kind of authentication a given login has.
2. It’s avoids having users type (or autofill) their passwords, so if one of (for example) BigCo’s vendors is compromised, the attackers don’t learn the passwords of BigCo employees.
In many cases SSO means once you’re logged in then you don’t enter a password again for the session anyway- that only works with a redirect.
and your login might not even be a password anyway, or require more information than just a password (like MFA)- our solution for example takes into consideration what you’re logging in to, what device you have and where you are to determine the secrecy level of the thing you’re authenticating into.
Can’t do that without control.