The PassiveRequestorEndpoint: where the browser is sent with wa=wsignin1.0 and wa=wsignout1.0.
The certificates its assertion signatures are verified against.
The token type URIs the security token service offers (fed:TokenTypesOffered); empty when it does not say.
What this module needs to know about the identity provider.