Hard to know without confirming configuration and seeing the behavior, but…
Before I went down too many rabbit holes:
1. Is this something that is critical? Wouldn’t someone with SSO have knowledge that they need to login to see the resource?
If critical, I would check the following:
1. File a Support Case after checking SuiteAnswers.
2. Is SSO the default configuration for all roles? Can it be? Does that change the behavior? >> TEST IN SB.
3. If it’s essential, and support calls it an enhancement, consider composing the url to include the target auth url based on use of SSO on the user’s role, instead of using the native functionality.