An IdP doesn't have to be on a VPN, no matter who operates it.