F5 BIG-IP as SP in IdP-initiated configuration

Hi engineers!

I've to configure F5 BIG-IP as SP in IdP-initiated configuration for SSO (SAMLv2).
Do you know documentation that can help me?

I also know that IdP-initiated conf. is dangerous because is not secure, and man-in-the-middle attacks are effective.
Does it make sense to create a site-to-site VPN between SP and IdP?

Thank you.