How to "intercept" first time SSO usages to let users confirm the SSO action and set a username?

Since I couldn’t find any existing documentation and got no reply here, we’re handling this on our end in our own web application now.