RBAC is paid for, but "Enterprise SSO" is different than the SSO supported in the Community Edition - it's described on their site as: "SSO with Enterprise Identity". They list: Okta, Sailpoint, Active Directory, OneLogin, G Suite, and Auth0 as examples. But, you still get SSO in Community Edition.