I'm reading about Salesforce SSO, I have some questions/clarification,
I find the concept of Delegated Auth, SP Initiated Login to be same since salesforce calls the external IDP or external service to verify user by posting tokens/certs. If so for SSO we need IDP server like Active Directory, for Delegated Auth we just need a web service or custom app for salesforce to post. Is this correct?
For SP initiated session, we are only configuring certification from IDP, at the time of login, if the user is not logged in IDP he needs to login to IDP first ? since the user name is not know by salesforce until IDP authenticates the users and returns assertion with user info, but salesforce only posts saml request?
PKI question - Idp possess private key, SP possess public key?