Sam wants to start a service provider-initiated single sign-on and redirect to their own application, myapp.com. Which of the following URLs is the…

To initiate a service provider (SP)-initiated single sign-on, the request must be sent to the SP's SSO endpoint in PingAM, which is spSSOInit.jsp. To redirect the user to a specific application (myapp.com) after successful authentication, the RelayState parameter must be used. The RelayState parameter is part of the SAML 2.0 specification and is used to preserve and convey state information from the SP to the Identity Provider (IdP) and back. In this context, it carries the ultimate destination URL where the user should be sent post-authentication.

A. idpSSOInit.jsp is used for IdP-initiated SSO, not SP-initiated SSO, which is what the question specifies.

B. This option incorrectly uses idpSSOInit.jsp for an SP-initiated flow and the non-standard goto parameter instead of RelayState.

C. While spSSOInit.jsp is correct for SP-initiated SSO, the goto parameter is not the standard SAML parameter for the final redirect URL; RelayState is.

1. Ping Identity, Access Management 7.5 Documentation, "SAML v2.0 Guide > Implementing SAML v2.0 > Initiating Single Sign-On". The guide details the different SSO initiation endpoints, specifying spSSOInit.jsp for SP-initiated flows.

2. OASIS, "Security Assertion Markup Language (SAML) V2.0 Core Specification", March 2005. Document identifier sstc-saml-core-2.0-os. Section 3.4.1, "AuthnRequest Protocol", describes the use of the RelayState parameter to include "private correspondence" that is returned unmodified to the requester. This is the standard mechanism for passing the target URL.