Where you state 'external app', are you referring to a non-Pega application?  Can you add more details about your use case?

All you have to do is provide the URL in the iframe to the Authentication service URL if the target application is Platform you'd use the SSO URL with the authentication service instead of the default URL. If the target is a non-Pega application you'd use whatever URL they provide to you and the fact that is authenticating via SAML or not should be completely transparent to you.