I think my example is unclear, the heading tells already what I want to achieve.
We currently have GitLab SSO for Mattermost. And we have client certificates for GitLab. Both works fine and we like it.
The problem we would like to solve is, that we want to access Mattermost from devices like the mobile or a tablet without installing the client certificates there. These devices don’t need access to GitLab at all and we want to have as little as possible devices with valid client certificates.
We could just switch from SSO to Email/Password for all users, that would work. My question was: can we have the best of both worlds? Log in with SSO if available clicking on the GitLab button, but sign in with the same user account using Email/Password if SSO is not possible on the current device.