If one requires all clients to auth via SSO, there currently is no mechanism to allow this, short of specifying the whole world in the subnet list, i.e. 1.0.0.0/0 - 254.254.254.254/0

One would imagine that specifying 0.0.0.0/0 would achieve this but it does not.
I've had a look at this but binary arithmetic makes my face hurt.

Could the 'address_in_subnet'/type 1 test be modified to account for a subnet/mask of 0.0.0.0/0?
Or would it be more sensible to have a config option to allow SSO for all clients without needing to specify an unintuitive catch-all mask of 0.0.0.0/0

Cheers