SAML Username Collision Leading to Full ATO

I was testing an application that supported both local accounts and SAML-based SSO. Nothing looked obviously broken. Signatures were valid…