<div dir="ltr"><div>Hi all,<br><br></div>I see an entry in the shibboleth2 wiki which states the following about configuring a shibboleth sp to work with pingone's IDP.<br><br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">
When configuring Shibboleth SP to use a PingFederated (PingIdentity)
IdP, do not use the "/idp/startSSO.ping" endpoint as this is a
proprietary Ping endpoint for IdP-Initiated SSO which is not for SAML 2
requests and will drop the RelayState parameter. Use the
"/idp/SSO.saml2" endpoint for expected Shibboleth SP behavior<br></blockquote><div><br></div><div>But I have no idea where to actually set that endpoint.<br><br></div><div>For other route-to specific-idp scenarios, I have stuff like this in my session initiator:<br>
<br><Path name="someidp" entityID="urn:mace:incommon:idps.entityid" /><br><br></div><div>In my metadata section, the entity id for the idp gets defined and everything works.<br><br></div><div>With pingone if I try that, their IDP throws an error<br>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><p>REQ_002a[f3c6319c]</p>
<p>The system is unable to determine which IdP to use for
your SSO request. Please add idpid parameter to your SSO request (e.g.
<a href="https://sso.connect.pingidentity.com/sso/idp/SSO.saml2?idpid=">https://sso.connect.pingidentity.com/sso/idp/SSO.saml2?idpid=</a><idpid>),
perform an IdP-initiated SSO or PingOne-initiated SSO first.</p></blockquote><div>I (perhaps mistakenly) assume this is related to the ping post on the shibboleth wiki, but I have no idea where to override the endpoint.<br>
<br></div><div>Could someone who has successfully integrated their SP with PingOne, I would appreciate any pointers you can provide.<br><br></div><div>Thanks,<br><br>James<br></div></div></div>