SP initiated URL icon on Webtop

You should be able to just add the same URL you can navigate to directly. When you click the link it should generate a redirect to the SP URL, which then issues a SAMLRequest message in a redirect (or POST) to the IdP. After authenticating, the client is redirected (via POST) back to the SP with a SAMLResponse message containing the authenticated assertion. From a user experience perspective, he sees the logon process to get to the portal, the webtop, then the IdP authentication URL, and then the SP (SaaS app).