It seems that currently while primary login is via SSO, it's not really possible to enable double puppeting. Please support it if password auth is not enabled.