The UCS 5 portal has to be configured manually to make a SSO login with the UCS single sign on IdP. The default operation mode is a local login, so clicking on a portal tile with a saml service will require the user to login again. When reconfiguring the portal to use SSO (ucr set portal/auth-mode=saml), there is no fallback to the local login in case a configuration error of the SAML IdP makes the SSO login not work in the domain or from the users computer.