When Salesforce acts as a SAML IdP to a third-party SP, what must be configured in Salesforce (Connected App as SAML SP) and what metadata does Salesforce provide to the SP?