Telmo,
One other thing that might be worth looking at when you have a moment. We have an application that connects 2 two different OKTA instances. One for clients to access applications and another for Internal staff ie our corporate SSO solution. To address we have cloned the IDP. The module/Espace name, "IDP," however is hard coded in espace name of GetEntryURL, so maybe a variable instead?