AAA, NAC, Guest Access & BYOD

Does ClearPass need direct access to the IDP(Identity Provider) when acting as SP (Service Provider) or access to the SP (Service Provider) when acting as IDP(Identity Provider)

No, ClearPass neither needs direct access to the IDP when acting as SP nor direct access to the SP when it acts as an IDP. This is because during the SSO process using SAML, all the interaction happens between the IDP and SP through the client browser so there is no need for ClearPass to have direct connectivity to the IDP or SP irrespective of whether its acting as IDP or SP. Its the client that needs access to both the IDP and SP so that it can carry the communication back and forth between the IDP and SP, authenticating across the IDP for getting access to the resources from the SP.