the model is that the   dumb   client contacts keystone  the sp  and asks it for a saml request to send to the idp  being   dumb   it is not able to create this message itself once the client gets the response from the idp it passes it to keystone for validation 