The IdP uses some apropriate means to identify the user. This is probably going to involve a campus SSO system - we use Raven (which in turn uses the UcamWebauth protocol 'on the wire')
The outcome of this is that the IdP now knows the identity of the browser user.