I think you were doing all good. Just need to add a new policy to your privacyIDEA, because (as you have noticed before) if you are using Authsource, simpleSAML needs more info from PI about the user.
If you don’t know how to add this policy, try to follow the instruction in this question: