Here are the steps to enable communities as IDP, note it is very similar to the regular salesforce as IDP .
Create a my domain for your organization. It is under the Domain Management in set up
Under Security control find Identify Provider tab and click "Enable Identity Provider" for the org.
Create a connected app with "Enable SAML" checkbox checked. ...
For creating a user account - you can call an out of the box REST API, it sounds like you're walking down this path. While you can (for example) create a single User object (record) in one REST call via an out of the box API, more than one record of one or more object type may need to be created for a user to be fully provisioned. You can use a Composite ...
You can create a Site and add a redirect from a Site URL to a destination. The destination can be any relative or absolute URL, including a MyDomain URL.
Out of the box, the hostname of the site will be auto-generated and added to a DNS for you by Salesforce. You have an option of using your own, custom domain controlled by your own DNS instead of having ...
All 3 of your scenarios would likely work however would require significant changes so I went with a different solution:
In my Community code, keep track of when the user last logged in.
If elapsed-time since user last logged in < the SecureAuth IdP session lifetime,
And If the user is not logged into the community,
Store the page the user is trying ...
You can control this scenario by leveraging the Okta auth provider that you've already configured as well as enabling (but not needing to set up) Delegated Authentication.
Per the help article on the topic:
SSO Login Settings Tips
When you configure users with an authentication ...
The only way I can think to accomplish this, and I have no way of guaranteeing this will work, is to:
Configure the URL to point directly to SecureAuth login url
Configure SecureAuth to redirect to your community whether or not they are currently logged in (bypass login screen at this stage)
Configure the login link to push back to SecureAuth, maybe to a ...
So this, according to the documentation, is not an option for SSO sessions, though it is for other session types as found here:
The answer is yes to both questions.
However, the important thing to note about the timeout value is that you shouldn't necessarily expect perfect timing due to how the system checks for activity as noted in the description of timeout value here
The last active session time value isn’t updated until halfway through
the timeout period. So if you have a ...
From reading the documentation, it does seem as though SAML is supported as long as it is configured in the Connected App (https://developer.salesforce.com/docs/atlas.en-us.externalidentityImplGuide.meta/externalidentityImplGuide/external_identity_authorize_web_app.htm). As for staying logged in, I would imagine a cookie gets stored after the login process ...