SP-Initiated Single Sign-On
Enter the IdP metadata URL to resolve SSO endpoint and certificate
Leave empty to let the IdP decide the NameID