Your problem is probably clustering, preventing in-memory relay state from working. Switch relayState to "cookie" and see what happens. I don't understand what this has to do with "specifying target in the <SSO> element", that is nothing anybody should ever do, it's for very odd use cases. -- Scott