Post to external web page

Okay, so if I understand this, you need to take some value from the SAML assertion (consumed by your APM SP configuration), and then POST it to a downstream server. Is that correct? If so, then the decoded/decrypted assertion should already be in the session table under session.saml.last.assertion, as well as individual assertion values in the session.saml.last. namespace. Do you need the whole thing or just a specific value?

The next question then is how to send that data to the web server. Is the application expecting a POST as the first request? If so, then you'd need to reformat the incoming GET request (after policy evaluation) to a POST and add the new payload. Would you need to do this more than once?