Auto-connect with 'env variable', without clicking on button?

Hello,

Is it possible to auto-login the user, when Apache already populated REMOTE_USER, whithout having to click on the "Connect by SSO" button on the login page?

The problem is that the SSO button integrate in the URL a token, and If I ask Apache to reach the index.php/apps/user_saml/saml/login page without this token (as it obviously changes each time I can't put it in Apache config), I have a "CSRF check failed" error message...

My Apache config:

# Direct login for connections on my server web root
RedirectMatch ^/$ /drive/index.php/login?direct=1

# SSO login when connecting to /drive-sso/
RedirectMatch ^/drive-sso/$ /drive/index.php/apps/user_saml/saml/login

# Ask for a valid X509 client certificate on user_saml login page
<Location "/drive/index.php/apps/user_saml/saml/login">
    SSLVerifyClient     require
    SSLVerifyDepth      1
    SSLOptions          +StdEnvVars
    SSLRequireSSL
    # REMOVED : all my SSL certificates checks

    # Filling REMOTE_USER with the "fisrtname.latname" part of then SSL email field
    RewriteEngine   On
    RewriteCond %{SSL:SSL_CLIENT_S_DN_Email} ^(.+)@.+$
    RewriteRule .* - [E=REMOTE_USER:%1]
</Location>

Server configuration

Operating system:
Debian 9 stable

Web server:
Apache 2.4.25

Database:
MariaDB 10.1.26

PHP version:
7.0.49

Nextcloud version: (see Nextcloud admin page)
13.0.4 stable

Where did you install Nextcloud from:
.tar.gz file on official Nextcloud website

List of activated apps:

Enabled:
  - activity: 2.6.1
  - dav: 1.4.7
  - federatedfilesharing: 1.3.1
  - files: 1.8.0
  - files_antivirus: 1.2.0
  - files_rightclick: 0.8.4
  - files_sharing: 1.5.0
  - files_texteditor: 2.5.1
  - files_trashbin: 1.3.0
  - files_videoplayer: 1.2.0
  - gallery: 18.0.0
  - logreader: 2.0.0
  - lookup_server_connector: 1.1.0
  - notifications: 2.1.2
  - oauth2: 1.1.1
  - password_policy: 1.3.0
  - provisioning_api: 1.3.0
  - serverinfo: 1.3.0
  - systemtags: 1.3.0
  - theming: 1.4.5
  - theming_customcss: 1.0.0
  - twofactor_backupcodes: 1.2.3
  - updatenotification: 1.3.0
  - user_saml: 1.5.0
  - workflowengine: 1.3.0
Disabled:
  - admin_audit
  - comments
  - encryption
  - federation
  - files_external
  - files_pdfviewer
  - files_versions
  - firstrunwizard
  - nextcloud_announcements
  - sharebymail
  - survey_client
  - user_external
  - user_ldap

Nextcloud configuration:

select * from oc_appconfig where appid='user_saml';
+-----------+--------------------------------------------+-----------------------+
| appid     | configkey                                  | configvalue           |
+-----------+--------------------------------------------+-----------------------+
| user_saml | enabled                                    | yes                   |
| user_saml | general-allow_multiple_user_back_ends      | 1                     |
| user_saml | general-idp0_display_name                  | Certificat SSL        |
| user_saml | general-require_provisioned_account        | 0                     |
| user_saml | general-uid_mapping                        | REMOTE_USER           |
| user_saml | installed_version                          | 1.5.0                 |
| user_saml | saml-attribute-mapping-displayName_mapping | SSL_CLIENT_S_DN_CN    |
| user_saml | saml-attribute-mapping-email_mapping       | SSL_CLIENT_S_DN_Email |
| user_saml | type                                       | environment-variable  |
| user_saml | types                                      | authentication        |
+-----------+--------------------------------------------+-----------------------+

Client configuration

Browser:
IE11, FF

Operating system:
Windows

Logs

Nextcloud log (data/owncloud.log)

# 1st access: will redirect to saml login page
"GET /drive-sso/ HTTP/1.1" 302 -/- (-%)

# Block, and ask for valid certificate
"GET /drive/index.php/apps/user_saml/saml/login HTTP/1.1" 403 -/- (-%)

# Error CSRF displayes on the page
 "GET /drive/index.php/apps/user_saml/saml/login HTTP/1.1" 412 -/- (-%)

Start by tracing the user_saml route at index.php/apps/user_saml/saml/login and its environment-variable authentication flow, using the supplied Apache configuration and REMOTE_USER mapping as the reproduction setup. Define what should happen when REMOTE_USER is already populated, including the expected redirect and CSRF behavior, then verify the result against the reported 403 and 412 responses.