Constraints:

• We need to include the metadata or a reference to metadata in the SSO Relay State. This allows us to attempt to use the new metadata when logging in
• The SSO URL, including the relay state, must be < 2048 chars because that's the limit for Microsoft Entra. That means we cannot include the entire metadata because it's possible the metadata + rest of URL is > 2048 chars
• metadata can expire fetch SAML metadata from URL if expiring #9237, so a URL that permalinks to an updated metadata XML is advantageous
• Google doesn't provide a URL so we'll have to ask users to host, accept a metadata XML & host it ourselves (via URL or in a DB table)

ran into this again, it's annoying having to special case both google & microsoft.

here's how i'd like to build it:

• the UI prompts for metadata URL
• there's a hint that says "No URL? Click here to paste metadata"
• the metadata URL form field changes to a metadata field
• they paste the metadata which takes in the metadata, uploads it to the storage & returns a URL. similar to how you paste images in github issues
• this could be a separate call, or combined into parseSAMLMetadata I opt for the former since it's cleaner, albeit results in 2 round trips

Prioritized