SAML: Differentiate between logout of external Community versus internal user

Question

We have an org + custom developer portal + Customer Community where:

Org does not use MyDomain; Community does use custom Domain forums.foo.com

   # TYPE OF USER    LOGIN TARGET                            LOGIN MECHANISM
   1 Internal        Sales/Service Cloud                     login.salesforce.com
   2 Internal        Customer Community                      Global header
   3 Internal        Developer Portal/Customer Community     SSO via in-house IdP
   4 External        Developer Portal/Customer Community     SSO via in-house IdP 

We're using Federated SSO; internal users have FederationIds to support use case #3

NOTE that SSO is not used to login to Sales/Service Cloud; only the Customer Community.

NOTE Salesforce is the Service Provider in use case 3 and 4

Goal:

• When user logged in via IdP, Logout should go back to IdP login page
• When user logged in via login.salesforce.com, Logout should go back to login.salesforce.com

Equally valid, acceptable goal:

• If internal user, logout goes to login.salesforce.com
• If external user, logout goes to IdP login page

We have a custom Logout URL in the SSO setup: myIdp.foo.com/saml/logout

When the SSO custom logout page is reached, what we have observed is the HTTP header referrer property (in PROD) is always the same regardless of use case:

   # TYPE OF USER    LOGOUT VIA                            REFERRER
   1 Internal        Sales/Service Cloud Logout            naXX.salesforce.com                    login.salesforce.com
   2 Internal        Customer Community Logout             naXX.salesforce.com
   3 Internal        Customer Community Logout             naXX.salesforce.com
   4 External        Customer Community Logout             naXX.salesforce.com 

Options considered:

1. We had hoped that if the logout came from the Community forums.foo.com, that the HTTP header referrer would be that domain but it isn't.

2. Merge fields like $User.UserType aren't allowed in SSO custom logout URLs.

So, since Logout is always going to the custom SSO/IdP logout page, how do we tell it from whence the logout occurred so we can redirect to the relevant login page?