Improve SAML configuration creation and consumption flow

[matthewelwell]

There are 2 main issues with the SAML configuration creation and consumption flow:

1. When creating a SAML configuration, the user needs to add a 'name'
2. Authenticating users have to input this name when using SAML to authenticate with that organisation

I'd like to improve this by removing the manual input step, and giving organisations dedicated URLs to login so they don't need to enter the name.

The suggested approach is to have the API generate the name for them which should be a slug of their organisation name. If this already exists, the API should add additional random characters to the end of the name. The user should be able to modify the name if they choose to, but the input should not be editable by default. If the user submits a name that is already taken, the system should automatically add random characters to the end of the name, and present it back to them for confirmation.

When the SAML configuration is created, they should be given a custom Login URL that looks something like: https://app.flagsmith.com/login/?sso_idp=<configuration-name>. On browsing to that URL in an unauthenticated browser, the user should not be prompted with the regular login screen (as is the current behaviour if they set the sso_idp flag), but they should see a screen that just has a single button with the text 'Login to Flagsmith with SSO' or similar.

[khvn26]

I think removing "If this already exists," and "If the user submits a name that is already taken," from the spec will make the process slightly more secure — simply append a suffix regardless.

[SahilJat]

Makes sense to always append the suffix rather than only when there's a conflict — agree with @khvn26 . Aside from the security angle, it's also just simpler logic and sets a consistent expectation for users.
For the suffix, something like 6 random hex characters after the slug would work well — xxx-xxx-a3f9b2. Short enough to be shareable, random enough to be unique.
One thing I wasn't sure about — for the login URL, if someone navigates to ?sso_idp=<name>, should it completely hide the normal login form or just show the SSO button as the primary option with email/password still accessible somewhere? Hiding it entirely is cleaner UX but could be painful if the IdP goes down and admins are locked out.
Happy to contribute.