Hi All, I wanted to understand how saml works with canvas app. Does it work with only sf to sf application or it can work with canvas app hosted outside of salesforce as well?

Does Salesforce always need be identity provider for enabling saml for canvas app? If I'm using okta for salesforce and canvas app, can I initiate saml flow from salesforce to canvas app through connected app saml initiation method?

Thanks,

Ram