...
See step 6 of the ID-WSF ECP SSO Profile (section 6.3.2). This is a SOAP response to the Portlet containing the SAML response targeted to the WSP containing the delegated authentication token with which the Portlet will be able to authenticate to the WSP as the user.
Note that this delegated token may itself contain the capability to authenticate back to the IdP via a recursive act of delegation. This is orthogonal to the delegation that takes place to the WSP.
2.7. Portlet Forwards <samlp:Response> to Web Service Provider
...