Is it possible, via a session variable to get the role of a user – when the user is accessing via SSO (and there is no entry for them in the users table)?
The role value will be captured in the 'SEC_SESSION' table under the name 'SEC_ROLE.NAME' with a sessionvalue equal to the role used during the SSO log on.
Indeed you are correct. The SEC_ROLE.NAME appeared for me simply because I was editing that role just prior to testing the SSO and SEC_SESSION persisted the value. Upon further review I as well get same result as you via SSO, the SEC_ROLE.NAME is not appearing in the SEC_SESSION table attached to the SSO login.
You may get additional replies via this thread, but I recommend opening an SR to have the support team investigate this further.
