Small things worth noting

• Lots of crypto

• Further requests are quicker

• That was “SP first” - “IdP first” is also possible

• That was Browser/POST; there's also Browser/Artefact

• The WAYF can be provided by the SP

• Use of SAML (but SAML isn't Shibboleth)