I'm curious, we have a multi-domain environment, but only one of the domains is plugged into the JSS with an SSO.  My question is, for those accounts with the SSO, do we need to have a 'local' account setup in the jss for failover or can their domain account be used so long as well specify a local password?