idpCallback is the url to the callback servlet we configure in the IDP.
The default (example) uses "/Authn/Cas" - but I can't think of a good way to discover it (that is a servlet that is configured in the idp's web.xml).