Hello Donka,
thanks for your reply and delivering those relevant guides.
At the moment of my request I wasn't that deep in the topic in generell. Now I beware of the various logon procedures.
My question is answered by the fact, that when I'm setting SAML2.0 as the primary login module for the Fiori Launchpad ICF-node, it triggers an redirect to my internal Java Identity Provider. At this point the user authenticates and is then redirected back to the ABAP Stack with the Fiori Launchpad. So referring to my question, the OTP is delivered and verifiedby the identity provider machine.
Regards,
Julian Branahl