...
If your IdP uses the RemoteUser LoginHandler with Basic Authentication (not terribly likely, then it's likely that but possible), then you can simply extend the protection of your authentication setup to include the path to the ECP handler, which is /idp/profile/SAML2/SOAP/ECP
...