Weblogic SAML custom authenticator question

I have configured Weblogic 10.3 as a SAML identity provider but would like do custom authentication.  The documentation suggests that at the SAML config level I can configure a custom login URL, but what is not clear is what this custom end point needs to do.  I have tried creating a login servlet that does a custom login form, does my custom authentication, and then redirects to response.sendRedirect(response.encodeRedirectURL("/saml2/idp/sso/login-return"));

But how then does weblogic know the user principal for it's SAML response to the service provider?

The answer seems to be that I have to configure a custom authenticator, and that the "custom login URL" in SAML is just for the app to capture the login credentials and pass these via something like