---
title: About SP-initiated SSO with the SamlFederationHandler
description: SP-initiated SSO occurs when a user attempts to access a protected application directly through the SP. Because the user's federated identity is managed by the IDP, the SP sends a SAML authentication request to the IDP. After the IDP authenticates the user, it provides the SP with a SAML assertion for the user.
component: pinggateway
version: 2024.11
page_id: pinggateway:gateway-guide:federation-about-sp-init
canonical_url: https://docs.pingidentity.com/pinggateway/2025.11/gateway-guide/federation-about-sp-init.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-06-02T11:29:35Z
superseded_by: https://docs.pingidentity.com/pinggateway/2025.11/gateway-guide/federation-about-sp-init.html
---

# About SP-initiated SSO with the SamlFederationHandler

SP-initiated SSO occurs when a user attempts to access a protected application directly through the SP. Because the user's federated identity is managed by the IDP, the SP sends a SAML authentication request to the IDP. After the IDP authenticates the user, it provides the SP with a SAML assertion for the user.

The following sequence diagram shows the flow of information in SP-initiated SSO, when PingGateway acts as a SAML 2.0 SP:

![SP-initiated SSO sequence diagram](_images/saml-sp-initiated.svg)