SAML configuration with LTM exposed app

Dear all,

I need to expose an internal web application from my BigIP but I don't want to expose directly the application logon page. The developer said to me that it can support SAML so I was thinking to implement it on my F5. I don't understand what is the best configuration I can use, do I need both IDP and SP configured on the BigIP? Because if I configure it only as IDP the users need to access the application homepage before being redirected to the IDP, am I wrong?

Thank you in advance

Luca