[chrisplough]

You're correct, in that you'll need to create the OTM usernames and assigned roles within the OTM application. These usernames may not be the same as your organizations username standard.

When you pass the OTM username to OTM via the specified variable in the HTTP header, then OTM will automatically log that user in, without verifying the password. OTM is deferring all authentication to the SSO framework.

--Chris