Whose connections: the customer dashboard's pool or the bank dashboard's.
Whether an ACTIVE connection uses this Cognito provider name, matched exactly.
The Cognito provider name of the ACTIVE connection claiming the email's domain, or null. A domain is claimed by at most one live connection.
The IdP an address must sign in through: STAFF_IDENTITY_PROVIDER
for CFX staff, on the cfx-admin pool and never this audience's, else
its domain's ACTIVE connection (providerNameForEmail), else null.
Which tenant IdP a sign-in email belongs to, for the login page. Read-only on purpose: the SSO admin services also rewrite Cognito and are for operators, so the login page doesn't get one just to read a row.