code: func (tc *TeleportClient) ssoLogin(ctx context.Context, connectorID string, pub []byte, protocol string) (*auth.SSHLoginResponse, error) {
  	log.Debugf("samlLogin start")
  	// ask the CA (via proxy) to sign our public key:
  	response, err := tc.credClient.SSHAgentSSOLogin(SSHLogin{
  		Context:       ctx,
  		ConnectorID:   connectorID,
  		PubKey:        pub,
  		TTL:           tc.KeyTTL,
  		Protocol:      protocol,
  		Compatibility: tc.CertificateFormat,
  		BindAddr:      tc.BindAddr,
  	})
  	return response, trace.Wrap(err)
  }
docs: // samlLogin opens browser window and uses OIDC or SAML redirect cycle with browser