Using APM as a SAML IdP no SSO portal

What you have now is considered an "IdP-initiated" config. The user logs onto the webtop, and the various links generate a SAML assertions to their respective SPs. The opposite of this is an "SP-initiated" config, where the user goes to the SP first, which redirects to the IdP for authentication, and then back to the SP with the assertion. The configuration of this is very similar to what you already have, except instead of assigning the IdP profile to a SAML resource, you simply assign the IdP profile as an SSO to the primary access policy itself (with no webtop).