I've configure SSO with Environment Hub for a DE linked to our Hub. It works: hub-org-users can login without knowing the password on the mapped member-org-users.
So far, so good.
Now do I need to tell all my hub-org-users still the password of the mapped member-org in order to allow them to use tools like eclipse, ANT or dataloader?
I would like to avoid that. I would prefer providing them only with the security-token, since then I could deactivate hub-org-users and lock them out of ANY linked org with SSO enabled. If I give the password away, I can't lock them out easily form several hundreds of orgs linked to our hub.
What is the best practice to for central user handling (Developers) with the need to use API-longins on the member-org?