Arvados

When SSO provider is configured to use (exactly one of) either LDAP or local authentication:

• A user (who isn't already logged in) clicks the Workbench Log in button and gets redirected (through API server) to SSO provider
• SSO provider prompts for a username and password, using a standard bootstrap form (possibly as a modal/overlay).
• If authentication succeeds, call back to API server and from there to Workbench (as usual).
• If authentication fails, prompt again, showing the error message in a bootstrap alert-danger or whatever.
• Test cases: If authentication succeeds on a subsequent attempt -- with or without some "back" button use -- call back to API server rather than entering some default state like "continue to foo". IOW, make sure we don't lose "back to the workbench page I was originally trying to see" state when handling authentication failures.

AJAX instead of a regular form-submit: nice, but optional.