This message was deleted.

I have not ... I've only done SAML to Netscaler as I've never had Storefront reachable by external (for the IdP to return the SP aka storefront).

yeah done SAML on the Netscaler to OKTA loads of times and i am confortable with the process. This is the first time i ever had this requirement for connecting storefront to okta with SAML