This appears to be working - I can masquerade by logging into the SD8 site through my email login rather than SSO.