BIGIP IdP, SP, Webtop?

I have read documentation but I started to get confused with what I need.

I am trying to build a webportal (webtop) on my edge to allow access to protected systems.

The Webtop will present the BIGIP portal to authenticate and force MFA with DUO and create the assertions for the protected systems on the back side of BIGIP that are SAML based.

What would be the configuratio required to accomplish this?

Do I need to make BIGIP act as IdP, or SP or both? or Federate BIGIP portal?

Is there any documentation?