SAML IDP-initiated without webtop

I was definitely not listening when you said "IdP-initiated without the webtop", so I addressed that in your other post. Otherwise, yes I would typically separate IdP and SP functions into separate VIPs. If you think about it, SAML is a federation protocol. If you need SSO to different applications on the same VIP, you can do that without SAML.