There are several ways to achieve this. As mentioned before using the `SI Federation Gateway` can have benefits in certain scenarios for example when you have multiple sites which use this functionality. In this case the federation gateway can manage all the details for SAML SSO to the third party instead of each website.

If this is just a single site doing SAML SSO to a third party than it probably makes more sense to bypass SI and just do an `IDP initiated SAML SSO` to the third party, with Sitecore being the identity provider and the third party the service provider. There are some good libraries available to help with this for example [ComponentSpace][1]. These will help you save alot of development effort and will most likely be more secure than creating the SAML manually through `Microsoft.IdentityModel.Tokens.Saml2`


  [1]: https://www.componentspace.com/